m!dge– gprs/umts/hspa+/lte router - karcz gettingstarted...

Operating manual.

M!DGE– GPRS/UMTS/HSPA+/LTE router

.

1.96/27/2016

www.racom.euRACOM s.r.o. • Mirova 1283 • 592 31 Nove Mesto na Morave • Czech RepublicTel.: +420 565 659 511 • Fax: +420 565 659 512 • E-mail: [email protected]

Table of ContentsImportant Notice .................................................................................................................................. 5Getting started ..................................................................................................................................... 61. M!DGE router .................................................................................................................................. 7

1.1. Introduction ........................................................................................................................... 71.2. Key features ......................................................................................................................... 71.3. Standards ............................................................................................................................. 8

2. M!DGE in detail ............................................................................................................................... 93. Implementation notes .................................................................................................................... 11

3.1. Ethernet SCADA protocols ................................................................................................. 113.2. Serial SCADA protocols ..................................................................................................... 113.3. Network center ................................................................................................................... 113.4. VPN tunnels ....................................................................................................................... 11

4. Product .......................................................................................................................................... 124.1. Dimensions ......................................................................................................................... 124.2. Connectors ......................................................................................................................... 124.3. Indication LEDs .................................................................................................................. 164.4. Technical specifications ...................................................................................................... 184.5. Model offerings ................................................................................................................... 194.6. Accessories ........................................................................................................................ 19

5. Bench test / Step-by-Step guide ................................................................................................... 215.1. Connecting the hardware ................................................................................................... 215.2. Powering up your wireless router ....................................................................................... 215.3. Connecting M!DGE to a programming PC ......................................................................... 215.4. Basic setup ......................................................................................................................... 22

6. Installation ..................................................................................................................................... 236.1. Mounting ............................................................................................................................. 236.2. Antenna mounting .............................................................................................................. 236.3. Grounding ........................................................................................................................... 236.4. Power supply ...................................................................................................................... 23

7. Web Configuration ......................................................................................................................... 247.1. HOME ................................................................................................................................. 247.2. INTERFACES ..................................................................................................................... 257.3. ROUTING ........................................................................................................................... 557.4. FIREWALL .......................................................................................................................... 627.5. VPN .................................................................................................................................... 687.6. SERVICES ......................................................................................................................... 797.7. SYSTEM ........................................................................................................................... 1027.8. LOGOUT .......................................................................................................................... 122

8. Command Line Interface ............................................................................................................. 1238.1. General usage .................................................................................................................. 1238.2. Print help .......................................................................................................................... 1248.3. Getting config parameters ................................................................................................ 1258.4. Setting config parameters ................................................................................................ 1258.5. Updating system facilities ................................................................................................. 1268.6. Manage keys and certificates ........................................................................................... 1268.7. Getting status information ................................................................................................ 1278.8. Scan ................................................................................................................................. 1288.9. Sending e-mail or SMS .................................................................................................... 1288.10. Restarting services ......................................................................................................... 1288.11. Debug ............................................................................................................................. 1298.12. Resetting system ............................................................................................................ 130

3© RACOM s.r.o. – M!DGE– GPRS/UMTS/HSPA+/LTE router

8.13. Rebooting system ........................................................................................................... 1308.14. Running shell commands ............................................................................................... 1308.15. CLI commands history .................................................................................................... 1308.16. CLI–PHP ........................................................................................................................ 131

9. Troubleshooting ........................................................................................................................... 1369.1. Common errors ................................................................................................................ 1369.2. Messages ......................................................................................................................... 1369.3. Troubleshooting tools ....................................................................................................... 136

10. Safety, environment, licensing ................................................................................................... 13810.1. Safety instructions .......................................................................................................... 13810.2. Country of Origin ............................................................................................................ 14010.3. Warranty ......................................................................................................................... 141

A. Glossary ...................................................................................................................................... 142Index ................................................................................................................................................ 144B. Revision History .......................................................................................................................... 147

List of Figures1. Router M!DGE UMTS and M!DGE LTE .......................................................................................... 62.1. M!DGE front and terminal panel ................................................................................................... 94.1. Dimensions in millimeters ........................................................................................................... 124.2. Antenna connectors SMA ........................................................................................................... 124.3. 2× Eth RJ45 Plug - pin numbering ............................................................................................. 134.4. USB connector ........................................................................................................................... 134.5. Screw terminal ............................................................................................................................ 144.6. Reset button ............................................................................................................................... 154.7. Indication LEDs .......................................................................................................................... 164.8. Flat bracket ................................................................................................................................. 194.9. Demo case ................................................................................................................................. 206.1. Grounding ................................................................................................................................... 2310.1. Country of Origin declaration ................................................................................................. 140

List of Tables4.1. Pin assignment Ethernet interface ............................................................................................. 134.2. USB pin description .................................................................................................................... 134.3. Screw terminal pin assignment .................................................................................................. 144.4. Digital input levels ...................................................................................................................... 144.5. Digital output parameters ........................................................................................................... 144.6. Voltage Polarity connector misconnection Risks ........................................................................ 154.7. M!DGE interfaces and status indicators ..................................................................................... 164.8. RSSI/RSQ and LED colour ........................................................................................................ 174.9. Technical specifications .............................................................................................................. 18

M!DGE– GPRS/UMTS/HSPA+/LTE router – © RACOM s.r.o.4

M!DGE– GPRS/UMTS/HSPA+/LTE router

Important Notice

Copyright

© 2016 RACOM. All rights reserved.Products offered may contain software proprietary to RACOM s. r. o. (further referred to under the ab-breviated name RACOM). The offer of supply of these products and services does not include or inplyany transfer of ownership. No part of the documentation or information supplied may be divulged toany third party without the express written consent of RACOM.

Disclaimer

Although every precaution has been taken in preparing this information, RACOM assumes no liabilityfor errors and omissions, or any damages resulting from the use of this information. This document orthe equipment may be modified without notice, in the interests of improving the product.

Trademark

All trademarks and product names are the property of their respective owners.

Important Notice

• Due to the nature of wireless communications, transmission and reception of data can never beguaranteed. Data may be delayed, corrupted (i.e. have errors), or be totally lost. Significant delaysor losses of data are rare when wireless devices such as the M!DGE/MG102i are used in an appro-priate manner within a well‐constructed network. M!DGE/MG102i should not be used in situationswhere failure to transmit or receive data could result in damage of any kind to the user or any otherparty, including but not limited to personal injury, death, or loss of property. RACOM accepts no li-ability for damages of any kind resulting from delays or errors in data transmitted or received usingM!DGE/MG102i, or for the failure of M!DGE/MG102i to transmit or receive such data.

• Under no circumstances is RACOM or any other company or person responsible for incidental,accidental or related damage arising as a result of the use of this product. RACOM does not providethe user with any form of guarantee containing assurance of the suitability and fit for purpose.

• RACOM products are not developed, designed or tested for use in applications which may directlyaffect health and/or life functions of humans or animals, nor to be a component of similarly importantsystems, and RACOM does not provide any guarantee when company products are used in suchapplications.


Important Notice

Getting startedM!DGE Wireless Routers will only operate reliably over the cellular network if there is a strong signal.For many applications a flexible stub antenna would be suitable but in some circumstances it may benecessary to use a remote antenna with an extension cable to allow the antenna itself to be positionedso as to provide the best possible signal reception. RACOM can supply a range of suitable antennas.

1. Install the SIM cardInsert a SIM card into the SIM socket. Make sure the SIM is enabled for data transmission.

2. Connect the GSM/UMTS antennaFit a GSM/UMTS antenna. If needed, contact RACOM for suitable antennas and other details.

3. Connect the LAN cableConnect one M!DGE Ethernet port to your computer using an Ethernet cat.5 cable

4. Connect the power supplyConnect the power supply wires to the M!DGE screw terminals, ensuring correct polarity. Switchon the power supply.

5. Setting of IP address of the connected computerBy default the DHCP server is enabled, thus you can allow the Dynamic Host Configuration Protocol(DHCP) on your computer to lease an IP address from the M!DGE. Wait approximately 20 secondsuntil your computer has received the parameters (IP address, subnet mask, default gateway, DNSserver).As an alternative you can configure a static IP address on your PC (e.g. 192.168.1.2/24) so thatit is operating in the same subnet as the M!DGE. The M!DGE default IP address for the first Eth-ernet interface is 192.168.1.1, the subnet mask is 255.255.255.0.

6. Start setting up using a web browserOpen a web browser such as Internet Explorer or Firefox. In the address field of the web browser,enter default IP address of M!DGE (i.e. http://192.168.1.1); initial screen will appear. Follow theinstructions and use the M!DGE Web Manager to configure the device. For more details seeChapter 7, Web Configuration.

Fig. 1: Router M!DGE UMTS and M!DGE LTE

Note

M!DGE can be safely turned off by unplugging the power supply.


Getting started

1. M!DGE router

1.1. Introduction

Although M!DGE wireless routers have been specifically designed for SCADA and telemetry, they arewell suited to a variety of wireless applications. M!DGE HW and SW are ready to maintain reliable andsecure connections from a virtually unlimited number of remote locations to a central server. Bothstandard Ethernet/IP and serial interfaces are available. Moreover, two digital inputs and two digitaloutputs can be used for direct monitoring and control of application devices.

M!DGE versatility is further enhanced by two independent Ethernet ports. These can be configured toeither support two independent LANs (e.g. LAN and WAN settings), or simply connect two deviceswithin one LAN (effectively replacing an Eth switch). M!DGE software is based on proven components,including an Embedded Linux operating system and standard TCP/IP communication protocols.

Combining M!DGE with a MG102i two-SIM router in one network is quite straightforward because offully compatible interface settings and behaviour on all HW interfaces. Thanks to the compact size andversatility of M!DGE, wireless routers prove indispensable in many SCADA and telemetry, as well asPOS, ATM, lottery and security/surveillance applications.

M!DGE together with RACOM RipEX radio router offers an unrivalled solution for combining GPRSand UHF/VHF licensed radio in a single network. Even a single RipEX in the center of a M!DGE networkallows for efficient use of addressed serial SCADA protocols.

1.2. Key features

Mobile Interface Parameters

• Mobile Connection options: HSPA+, HSDPA, HSUPA, UMTS, EDGE, GPRS, GSM and LTE• Global connectivity• Transparent hand-over between 2G and 3G (M!DGE UMTS) or 2G, 3G and 4G (M!DGE LTE)

Power supply

• Redundant dual power input pins• Input voltage: 10.2 – 57.6 VDC• Max. power consumption: 5 W

Services /Networking

• Fallback Management• Connection supervision, Automatic connection recovery• Quality of Service (QoS)• OpenVPN, IPsec, PPTP, GRE, Dial-In• VRRP• DHCP server, DNS proxy server, DNS update agent• Telnet server, SSH server, Web server• NTP• Device server, Protocol server, SDK• Port Forwarding (NAPT)• Firewall, Access Control Lists


M!DGE router

Interfaces

• 2 Ethernet ports: LAN, WAN/LAN• RS232• 2× DI, 2× DO• USB host

Diagnostic and Management

• Web interface, CLI available• File configuration• OTA SW update• Advanced troubleshooting• SMS remote control, SMS and E-mail notification• SNMPv1/v2c/3

1.3. Standards

EN 301 489-1 V1.9.2EMCEN 301 489-7 V1.3.1EN 301 489-17 V2.2.1EN 301 489-24 V1.5.1EN 300 328 V1.8.1EN 300 440-2 V1.4.1EN 50 121-3-2:2006EN 50 121-4:2006EN 55022:2010EN 55024:2010EN 61 000-6-2:2005EN 301511 V9.0.2RadioEN 301893 V1.7.1EN 60950-1 +A11:2006/2009Electrical Safety

+A1 +A12:2010/2011EN 62311:2008IP40IP ratingIEEE 802.3iETHIEEE 802.3uIEEE 802.3af


M!DGE router

2. M!DGE in detail

Fig. 2.1: M!DGE front and terminal panel

All M!DGE Wireless Routers run M!DGE Software. Software offering the following key features:

• Interfaces and Connection Management (Section 7.2, “INTERFACES”) Dial-out (permanent, on switchover, distributed) Link Supervision Fallback to backup profile SIM and PIN management Automatic or manual network selection Ethernet (LAN, WAN, bridging, IP passthrough, VLAN management) USB (autorun, device server) Serial port (login console, device server, protocol server, SDK) Digital I/O

• Routing (Section 7.3, “ROUTING”) Static Routing Extended Routing Multipath Routes Bridging Mobile IP Quality of Service (QoS)

• Security / Firewall (Section 7.4, “FIREWALL”) NAPT / Port Forwarding Stateful Inspection Firewall Firewall

• Virtual Private Networking (VPN) (Section 7.5, “VPN”) OpenVPN Server/Client IPsec Peer PPTP Server/Client GRE Peer Dial-in Server


M!DGE in detail

• Services (Section 7.6, “SERVICES” ) SDK NTP Server DHCP Server DNS Server Dynamic DNS Client E-mail Client Notification via E-mail and SMS SMS Client SSH/Telnet Server SNMP Agent Web Server Redundancy

• System Administration (Section 7.7, “SYSTEM”) Configuration via Web Manager Configuration via Command Line Interface (CLI) accessible via Secure Shell (SSH) and telnet Batch configuration with text files User administration Troubleshooting tools Over the air software update Licensing (extra features) Keys and certificates (HTTPS, SSH, OpenVPN, ...) Legal Notice


M!DGE in detail

3. Implementation notes

3.1. Ethernet SCADA protocols

SCADA equipment with an Ethernet protocol behaves as standard Ethernet equipment from a commu-nications perspective. Thus the communication goes transparently through the GPRS/UMTS/LTEnetwork. The implementation requires heightened caution to IP addressing and routing. NAPT function-ality should be used frequently.

3.2. Serial SCADA protocols

A SCADA serial protocol typically uses simple 8 or 16 bit addressing. The mobile network addressscheme is an IP network, where range is defined by the service provider (sometimes including individualaddresses, even in the case of a private APN). Consequently, a mechanism of translation betweenSCADA and the IP addresses is required. To make matters worse, IP addresses may be assigned toGPRS (EDGE, UMTS, etc.) devices dynamically upon each connection.

Please read Chapter 1 in the application note "SCADA serial protocols over GPRS routers"1 whichdescribes how to efficiently solve this problem using RACOM routers.

3.3. Network center

In every network, the center plays a key role and has to be designed according to customer's require-ments. Several possible solutions are described in the application note's Chapter 2 – M!DGE / MG102iCENTER2.

3.4. VPN tunnels

Customer data security arriving through the mobile network is often very important. Private APN is thebasic security requirement, but not safe enough for such applications.

VPN tunnels solution is closely connected with the center and is also briefly described in the givenapplication note.

1 http://www.racom.eu/eng/products/m/midge/app/scada.html2 http://www.racom.eu/eng/products/m/midge/app/midge-mg102i_centre.html


Implementation notes

http://www.racom.eu/eng/products/m/midge/app/scada.html

http://www.racom.eu/eng/products/m/midge/app/midge-mg102i_centre.html

http://www.racom.eu/eng/products/m/midge/app/midge-mg102i_centre.html

4. Product

4.1. Dimensions

Fig. 4.1: Dimensions in millimeters

4.2. Connectors

4.2.1. Antenna SMA

Fig. 4.2: Antenna connectors SMA

The UMTS model has one SMA an-tenna connector.

The LTE model is equipped with twoantenna connectors. The ANT connect-or (above) serves as a main antennaconnection, the second connector isauxiliary and serves for better commu-nication with BTS (diversity).


Product

4.2.2. 2× Eth RJ45

Fig. 4.3: 2× Eth RJ45 Plug - pin numbering

Tab. 4.1: Pin assignment Ethernet interface

ETH (Ethernet 10Ba-seT and 100BaseT)

RJ-45Socket

signalpinTX+1TX−2RX+3RX−6

4.2.3. USB

M!DGE uses USB 1.1, Host A interface. USB interface is wired as standard:

Fig. 4.4: USB connector

Tab. 4.2: USB pin description

wiresignalUSB pinred+5 V1

whiteData (−)2greenData (+)3blackGND4

4.2.4. Screw terminal

Screw terminal plug type Stelvio Kontek CPF5/15 or MRT3P/15V01 can be used.


Product

Fig. 4.5: Screw terminal

Tab. 4.3: Screw terminal pin assignment

signalpin descriptionpinGround internally connected with casing ground.VGND1Dual power input - not connected with pin 4: 12–48 VDC(−15 % +20 %) = 10.2–57.6 VDC.V+ (12–48 V=)2

Ground internally connected with casing ground.VGND3Dual power input – not connected with pin 2: 12–48 VDC(−15 % +20 %) = 10.2–57.6 VDC.V+ (12–48 V=)4

RS232 – RxD (receiving data)RxD5RS232 – TxD (transmitting data)TxD6RS232 – GND (ground)GND7

Digital output. Dry contact relay. Normally open with M!DGEwithout powering.DO1:

89

Digital output. Dry contact relay. Normally open with M!DGEwithout powering. See Section 7.2.6, “Digital I/O” for details.DO2:

1011

Digital input 1DI1−12Digital input 1DI1+13Digital input 2DI2−14Digital input 2 – see Section 7.2.6, “Digital I/O”DI2+15

Tab. 4.4: Digital input levels

0 to 5.0 VDClogical level 07.2 to 40 VDClogical level 1

Note: Negative input voltage is not recognised.

Tab. 4.5: Digital output parameters

1 AMaximal continuous current60 VDC, 42 VAC (Vrms)Maximal switching voltage60 WMaximal switching capacity


Product

Tab. 4.6: Voltage Polarity connector misconnection Risks

Plug pos.Plug pos.Plug pos.Plug pos.pin descriptionpin−−

Nde+

OK−VGND1

OK+

Nde−−+V+ (12–48 V=)2

−+Nde

+OK

−VGND3

Nde+

Nde−−+V+ (12–48 V=)4

−+Dp [1]

+Dp [1]

−RxD5

Dp [1]+

Dp [1]−−+TxD6

−+Nde

+Nde

−GND7

Nde [2]+

Nde [2]−−+DO1-18

−+Nde

+Nde

−DO1-29

Nde [3]+

Nde [3]−−+DO2-110

−+Nde

+Nde

−DO2-211

Nde [4]+

OK [4]−−+DI1−12

−+Nde

+Nde

−DI1+13

Nde [4]+

OK [4]−−+DI2−14

−+DI2+15

Explanatory notes for the table:OK - Normal operationDP - Damage possibleNde - No damage expected

[1] - If the applied voltage is > 15 V, damage is likely[2] - If the relay is closed (normally open), the relay is damaged when current > 5 A[3] - If the relay is closed (normally closed), the relay is damaged when current > 5 A[4] - If the applied voltage is > 40 V, input circuit damage is likely

4.2.5. Reset button

Fig. 4.6: Reset button

The Reset button is placed close to the screw terminal and it is labeled"Reset". Use a blunt tool no more than 1 mm in diameter (e.g. a paperclip) to press the button.

Keep it pressed for at least 3 seconds for reboot and at least 10 secondsfor a factory reset. The start of the factory reset is confirmed by all LEDslighting up for one second. The button can be released afterwards.


Product

4.3. Indication LEDs

Fig. 4.7: Indication LEDs

Tab. 4.7: M!DGE interfaces and status indicators

FunctionStateLabelStart up, maintenancegreen blinking

StatusReady (right side banks description)green onReady (left side banks description)orange onInsufficient power supplyorange blinkingMobile connection is being establishedblinking

ConnectMobile connection is uponExcellent GSM signalgreenMedium GSM signalorangeWeak GSM signalredVPN connection is upgreen on

VPNVPN connection is being establishedgreen blinking

If left side banks displayedClosedon

DO1OpenedoffClosedon

DO2OpenedoffInput seton

DI1Input not setoffInput seton

DI2Input not setoff


Product

Tab. 4.8: RSSI/RSQ and LED colour

redorangegreengreenColourn/aweakmediumgoodexcellentDescription-113 or less-86 to -112-81 to -85-64 to -80-63 or moreGSM RSSI [dBm]-113 or less-98 to -112-81 to -97-64 to -80-63 or moreUMTS RSSI [dBm]-21 or less-10 to -20-7 to -9-5 to -6-4 or moreLTE RSRQ [dB]


Product

4.4. Technical specifications

Tab. 4.9: Technical specifications

Mobile Interface UMTSWCDMA, HSDPA, HSUPA, HSPA+: bands1, 2, 5, 8EDGE, GPRS: 850/900/1900 MHzData rates: max. 14.4 Mbps Downlink / 5.76 Mbps uplink

Mobile Interface LTE

LTE: bands 1, 2, 3, 5, 7, 8, 20, all bands withs diversityWCDMA, HSPA, HSPA+: bands 1, 2, 3, 5, 8, all bands withs diversityGSM, GPRS, EDGE: 850/900/1800/1900 MHzData rates up to 100 Mbps downlink / 50 Mbps uplink

2× Ethernet 10/100 Base-T, Auto MDX, 2× RJ45, bridged or routedEthernet1× 3-wire RS232 on 15-pin screw terminal blockSerial Interface

2 digital inputs

Digital I/O

0–5.0 VDC level 07.2–40 VDC level 1, maximum voltage 40 VDC

2 digital outputs

Relay outputs 1st NO, 2nd NCLimiting continuous current 1 AMax. switching voltage 60 VDC, 42 VAC (Vrms)Maximum switching capacity 60 W on 15-pin ter-minal block

USB service interfaceUSB host interface supporting memory devicesUSB type A connector

50 ΩImpedance:Antenna Interface

SMA femaleConnector:10.2–57.6 VDC (12–48 VDC −15 % / +20 %)Input voltage:

Power SupplyPower consumption:

Rx max. 3.2 WTx max. 5 W

Environmental Conditions

For indoor use only, IP40Metal casing, DIN rail mounting kit included

−25 to +70 °C (−13 to +158 °F)Temperature range UMTS:−25 to +60 °C (−13 to +140 °F)Temperature range LTE:0 to 95 % (non condensing)Humidity:> 220.000 hours (> 25 years)MTBF (Mean Time Between Failure)IIOvervoltage Category:2Pollution Degree:

DIN rail mountingMounting45 W × 110 D × 125 H mm (1.77 × 4.33 × 4.92 in), ca. 450 g (0.99 lbs)Dimensions / WeightCE, FCCType Approval


Product

OptionsVarious antennas suitable for your application are availableAntennasFlat bracket mounting kitMounting kit

4.5. Model offerings

M!DGE-UMTS GPRS/EDGE/UMTS/HSPA router, 2Eth, RS232, 2DI, 2DODIN rail holder included

M!DGE-LTE GPRS/EDGE/UMTS/HSPA+/LTE router, 2Eth, RS232, 2DI, 2DODIN rail holder included

SW feature keys

The SW feature key should be added to a new or running system via adding a license: menu SYSTEM– Licensing (see Section 7.7.7, “Licensing” ).

Mobile IP This key allows building a MobileIP VPN tunnel. See http://www.ra-com.eu/eng/products/m/midge/app/Backup_WAN_by_GSM.html#Mo-bile_IP_with_VPN_tunnels for short explanation.

Server Ext. OpenVPN server extension - without this key the maximum number of connectedclients shall reach 10. This key extends the number to 25.

4.6. Accessories

4.6.1. F bracket

Fig. 4.8: Flat bracket

Flat-bracket

Installation bracket for flat mounting. For usage details see chapter Mounting and chapter Dimensions.


Product

http://www.racom.eu/eng/products/m/midge/app/Backup_WAN_by_GSM.html#Mobile_IP_with_VPN_tunnels



4.6.2. Demo case

A rugged plastic case for carrying up to three RipEX units and one M!DGE 3G SCADA router. It alsocontains all the accessories needed to perform an on-site signal measurement, complete applicationbench-test or a functional demonstration of both radio modems and the 3G router. During a field test,units can be powered from the backup battery and the external antenna can be connected to one ofthe RipEX units through the „N“ connector on the case.

Fig. 4.9: Demo case

Contents:

• Brackets and cabling for installation of three RipEX units and one M!DGE (units not included)• 1× power supply Mean Well AD-155A (100-240 V AC 50-60 Hz/13.8 V DC)• 1× Backup battery (12V/5Ah, FASTON.250), e.g. Fiamm 12FGH23• 1× Power cable (European Schuko CEE 7/7 to IEC 320 C13)• 1× Ethernet patch cable (3 m, UTP CAT 5E, 2× RJ-45)• Quick start guide

RipEX accessories:

• 3× Dummy load antennas• 1× L-bracket, 1x Flat-bracket samples• 1× Fan kit• 1× X5 – ETH/USB adapter

M!DGE accessories:

• Whip antenna (900–2100 MHz, 2.2 dBi, vertical)• External dimensions: 455 × 365 × 185 mm• Weight approx. 4 kg (excluding RipEXes and M!DGE)


Product

5. Bench test / Step-by-Step guideBefore starting to work with the HW please be sure that you have a SIM card enabled for data and youhave all the necessary information from the mobile operator (PIN, APN, login, passwd)

5.1. Connecting the hardware

5.1.1. Install the SIM card

Insert a SIM card into the SIM socket. If the router has two SIM card sockets, use the first one. Makesure the SIM is enabled for data transmission.

There are two reasons for installing the SIM card as the first task: a) the SIM card could be damagedwhen inserted into the powered equipment, b) the information from SIM card are read only after a powercycle.

5.1.2. Connect the GSM/UMTS antenna

Fit a GSM/UMTS antenna. For details see Section 4.6, “Accessories” or contact RACOM for suitableantennas.

5.1.3. Connect the LAN cable

Connect one M!DGE/MG102i Ethernet port to your computer using an Eth cat.5 cable.

5.1.4. Connect the power supply

Connect the power supply wires to the M!DGE/MG102i screw terminals, ensuring correct polarity.Switch on the power supply.

5.2. Powering up your wireless router

Switch on your power supply. The status LED flashes for a few seconds and after 8 seconds it startsblinking to a green light. After approximately 30 seconds your router will have booted and will be ready;the Status LED remains shining.

When the Mobile Connection is enabled the Connect LED starts blinking while connecting to theGPRS/UMTS network – the color (green/orange/red) represents the signal strength (excellent, medium,weak).

You’ll find the description of the individual LED states in Section 4.3, “Indication LEDs”.

5.3. Connecting M!DGE to a programming PC

a. Please connect the Ethernet interfaces of your computer and M!DGE.b. If not yet enabled, please enable the Dynamic Host Configuration Protocol (DHCP) so that your

computer can lease an IP address from M!DGE. Wait a moment until your PC has received theparameters (IP address, subnet mask, default gateway, DNS server).

Alternative: Instead of using the DHCP, configure a static IP address on your PC (e.g.192.168.1.10 mask 255.255.255.0) so that it is operating in the same subnet as the M!DGE.


Bench test / Step-by-Step guide

The default IP addresses are:• 192.168.1.1 for Eth1• 192.168.2.1 for Eth2

The default subnet mask is 255.255.255.0 for all interfaces.c. Start a Web Browser on your PC. Type the M!DGE IP address in the address bar:

http://192.168.1.1d. Please set a password for the admin user account. Choose something that is both easy to remember

and a strong password (such as one that contains numbers, letters and punctuation). The passwordmust have a minimum length of 6 characters. It must contain a minimum of 2 numbers and 2 letters.

Note

For security reasons, there is no default password.

e. Agree to the terms and conditions. The user is now obliged to accept our end user license agree-ment during the initial M!DGE setup.

5.4. Basic setup

The M!DGE/MG102i Web Manager can always be reached via the Ethernet interface. After successfulsetup, Web Manager can also be accessed via the mobile interface. Any up to date web browser canbe used. Any web browser supporting JavaScript can be used. By default, the IP address of the Ethernetinterface is 192.168.1.1, the web server runs on port 80.

The minimum configuration steps include:

1. Defining the admin password2. Entering the PIN code for the SIM card3. Configuring the Access Point Name (APN)4. Starting the mobile connection

Note

Router (M!DGE or MG102i) can be safely turned off by unplugging the power supply.


Bench test / Step-by-Step guide

6. Installation

6.1. Mounting

M!DGE/MG102i Wireless Router is designed for a DIN rail mounting or on a panel using flat bracket.Please consider the safety instructions in Chapter 10, Safety, environment, licensing.

6.2. Antenna mounting

M!DGE/MG102i Wireless Routers will only operate reliably over the GSM network if there is a strongsignal. For many applications the flexible stub antenna provided would be suitable but in some circum-stances it may be necessary to use a remote antenna with an extended cable to allow the antenna itselfto be positioned so as to provide the best possible signal reception. RACOM can supply a range ofsuitable antennas.

Beware of the deflective effects caused by large metal surfaces (elevators, machine housings, etc.),close meshed iron constructions and choose the antenna location accordingly. Fit the antenna orconnect the antenna cable to the GSM antenna connector.

In external antennas the surge protection of coaxial connection would be required.

Note

Be sure that the antenna was installed according to the recommendation by the antennaproducer and all parts of the antenna and antenna holder are properly fastened.

6.3. Grounding

Grounding screw has to be properly connected with cabinet grounding using a copper wire with minimalcross section of 4 mm2.

Fig. 6.1: Grounding

6.4. Power supply

M!DGE can be powered with an external power source capable of voltages from 10 to 55 Volts DC.M!DGE should be powered using a certified (CSA or equivalent) power supply, which must have alimited and SELV circuit output.

M!DGE is equipped with dual power supply connector - it is possible to use two independent powersupplies (even with different voltage). The ground terminals are connected together and they are con-nected with the box grounding as well.


Installation

7. Web Configuration

7.1. HOME

This page gives you a system overview. It helps you when initially setting up the device and alsofunctions as a dashboard during normal operation.

The highest priority link which has been established successfully will become the so-called hotlinkwhich holds the default route for outgoing packets.

Detailed information about status of each WAN interface is available in a separate window.


Web Configuration

7.2. INTERFACES

Details for all physical connections are given in Section 4.2, “Connectors”.

7.2.1. WAN

Link Management

Each available item in the WAN Link Manager matches with the particular WAN interface - for addingan item, the respective WAN interface must be set (e.g. LAN, WWAN).

In case a WAN link goes down, the system will automatically switch over to the next link in order ofpriority (the priorities can be changed using the arrows on the right side of the window). A link can beeither established when the switch occurs or permanently to minimize link downtime.

1st priority: This link will be used whenever possible.

2nd priority: The first fallback technology.

Up to four priorities can be used.


Web Configuration

Outgoing traffic can also be distributed over multiple links on a per IP session basis. Choose the option"distributed" as an Operation Mode with the appropriate Weight.

In the following example, the outgoing traffic will be distributed between LAN2 (80 %) and WWAN1 (20%) links.

Note

This option is general and applies to all outgoing traffic. See section 7.3.3 Multiple Routesfor more detailed configuration.

We recommend using the permanent option for WAN links. However, in case of time-limited mobiletariffs, the switchover option should be used.

After clicking on the WWAN "Edit" button, you can additionally set the "IP passthrough" option for theLAN2 interface. The result is that the connected device over the LAN2 port will obtain M!DGE's/MG102i'smobile IP address via DHCP. In another words, M!DGE/MG102i will be transparent for the connecteddevice and will only serve for the mobile connectivity. Typically, such connected device (e.g. firewall)will not need any special configuration facing M!DGE/MG102i, it will just use its mobile IP address(usually the public IP address).

Once established, the Web manager can be reached over the port 8080 using the public address.


Web Configuration

Note

This option is configurable within WWAN links only. Remember that LAN1 cannot beused as the port for the IP passthrough functionality.

•

• LAN10 is not usable within M!DGE/MG102i routers. Do not select it.

Connection Supervision


Web Configuration

Network outage detection can be used for switching between available WAN links and can be performedby sending pings on each link to authoritative hosts. A link will be declared as down if all trials havefailed. The link will be considered up again if at least one host is reachable.

You may further specify an emergency action if no uplink can be established at all.

Configurable actions are:

• None• Restart link services• Reboot system

Link: The WAN link to be monitored (can be ANY for all configured links).

Mode: Specifies whether the link is monitored during the connection estab-lishment or only when it is already up.

Primary host: Reference host one which will be used for checking IP connectivity(via ICMP pings).

Secondary host: Reference host two which will be used for checking IP connectivity(via ICMP pings). The test is considered successful if either theprimary or the secondary host answers.

Ping timeout: Time for which the system is waiting for the ping response. Withmobile networks the response time can be quite long (severalseconds) in special cases. You can check the typical response usingSYSTEM – Troubleshooting – Network Debugging – Ping. The firstresponse typically takes a longer time than the following ones inGPRS/UMTS networks, the Ping timeout should be set to the longertime than with the first response.


Web Configuration

Ping interval: Time to wait before sending the next probe.

Retry interval (if ping failed): If the first trial fails, ping hosts in this modified interval until the pingis successful or the maximum number of failed trials is reached.

Max. number of failed trials: The maximum number of failed ping trials until the ping check willbe declared as failed.

Emergency action: Configure the Emergency action which should be taken after themaximum downtime is reached. Using "reboot" perfoms the systemreboot. The option "restart services" restarts all link-related applica-tions including the modem reset. No action is done if the "none"option is set. Configure the maximum amount of downtime in minutesfor which the link could not be established.

Settings

The maximum segment size defines the largest amount of data of TCP packets (usually MTU minus40). You may decrease the value in case of fragmentation issues or link-based limits.

MSS adjustment Enable or disable MSS adjustment on WAN interfaces.

Maximum segment size Maximum number of bytes in a TCP data segment.

7.2.2. Ethernet

Port Assignment

This menu can be used to individual assigning of Ethernet ports to LAN interfaces if you want to havedifferent subnets per port or to use one port as the WAN inteface.

If it is desired to have both ports in the same LAN you may assign them to the same interface. Pleasenote that the ports will be bridged by software and operated by running the Spanning Tree Protocol.


Web Configuration

Link negotiation can be set for each Ethernet port individually. Most devices support auto-negotiationwhich will configure the link speed automatically according to the existing devices in the network,however manual setting of 10 BaseT or 100 BaseT and Half or Full duplex can be set as well.

VLAN Management

M!DGE/MG102i routers support Virtual LAN according to IEEE 802.1Q which can be used to createvirtual interfaces on top of the Ethernet interface. The VLAN protocol inserts an additional header toEthernet frames carrying a VLAN Identifier (VLAN ID) which is used for distributing the packets to theassociated virtual interface. Any untagged packets, as well as packets with an unassigned ID, will bedistributed to the native interface. In order to form a distinctive subnet, the network interface of a remoteLAN host must be configured with the same VLAN ID as defined on the router. Further, 802.1P introducesa priority field which influences packet scheduling in the TCP/IP stack.

The following priority levels (from the lowest to the highest) exist:

VLAN Priority LevelsParameterBackground0Best Effort1Excellent Effort2Critical Applications3Video (< 100 ms latency and jitter)4Voice (< 10 ms latency and jitter)5Internetwork Control6Network Control7


Web Configuration

IP Settings

Two individual tabs will be used when different LANs are set in the Port settings menu. Each of themcan be configured either in the LAN mode or in the WAN mode.

Note

The default IP addresses are as follows: 192.168.1.1/24 (LAN1) and 192.168.2.1/24 (LAN2).

Static configuration of M!DGE's/MG102i's own IP address and Subnet mask is available for the LANmode. The Alias IP address enables configuring the LAN inteface with a second IP address/subnet.

Note

Setting of the IP address is interconnected with the DHCP Server (if enabled) - menu theSERVICES - DHCP Server menu.


Web Configuration

WAN mode enables the following possibilities:

DHCP client: The IP configuration will be retrieved from a DHCP server in the network. No furtherconfiguration is required (you may only set MTU).

Static IP: IP configuration will be set manually. At least the Default gateway and the PrimaryDNS server must be configured along with the IP address and subnet mask.

PPPoE: PPPoE is the preferred protocol when communicating with another WAN accessdevice (like a DSL modem).

Username: PPPoE user name to be used for authentication at theaccess device.

Password: PPPoE password to be used for authentication at theaccess device.

Service Name: Specifies the service name set of the access concentrat-or. Leave it blank unless you have many services andneed to specify the one you need to connect to.

Access ConcentratorName:

This may be left blank and the client will connect to anyaccess concentrator.


Web Configuration

7.2.3. Mobile

SIMs

The SIM page gives an overview about the available SIM cards, their assigned modems and the currentstates. Once a SIM card has been inserted, assigned to a modem and successfully unlocked, the cardshould remain in the ready and registered state. You may update the state in order to restart PIN un-locking and trigger another network registration attempt.

Configuration

A SIM card is generally assigned to a default modem but this may switch, for instance if you set up twoWWAN interfaces with one modem but different SIM cards. Close attention has to be paid when otherservices (such as SMS or Voice) are operating on that modem as a SIM switch will affect their operation.

You can configure the following parameters:

Default modem The default modem assigned to this SIM card.

Service type The default service type to be used with this SIM card. Remember that thelink manager might change this in case of different settings. The default optionis "automatic", in areas with interfering base stations you can force a specific


Web Configuration

type (e.g. 3G-only) in order to prevent any flapping between the stationsaround.

Registration mode The default option is set to "all networks". You can limit the modem registrationto "packet-switched only" (e.g. no Dial-in Server) or "circuit-switched only"option, which can be for example used for the Dial-in Server so one can usePPP over the Circuit-Switched Networks (analog modem style).

PIN protection Depending on the used card, it can be necessary to unlock the SIM with aPIN code. Please check the account details associated with your SIMwhether the PIN protection is enabled.

PIN code The PIN code for unlocking the SIM card

PUK code The PUK code for unlocking the SIM card if the card was blocked due toseveral wrong PIN attempts.

SMS gateway The service center number for sending short messages. It is generally retrievedautomatically from your SIM card but you may define a fixed number here.

Network

This page provides you with the information about the current network status, service type, signalstrength, CID (Cell ID), LAC (Local Area Code) and LAI (Local Area Identifier) to which the modem hasbeen registered. LAI is a globally unique number that identifies the country, network provider and LACof any given location area. It can be used to force the modem to register to a particular mobile cell incase of competing stations.

You may further initiate mobile network scan for getting networks in range and assign a LAI manually.

Query

This page allows you to send a Hayes AT command to the modem. Besides the 3GPP-conforming ATcommand set, further modem-specific commands can be applied which can be provided on demand.Some modems also support to run Unstructured Supplementary Service Data (USSD) requests, e.g.for querying the available balance of a pre-paid account.

WWAN Interfaces

This page can be used to manage your WWAN interfaces. The resulting link will pop up automaticallyon the WAN Link Management page once an interface has been added. The Mobile LED will beblinking during the connection establishment process and goes on as soon as the connection is up.Refer to the troubleshooting section or log files in case the connection did not come up.


Web Configuration

The following mobile settings are required:

Modem The modem to be used for this WWAN interface

SIM The SIM card to be used for this WWAN interface

Service type The required service type

Please note that these settings supersede the general SIM based settings as soon as the link is beingdialed.

Generally, the connection settings are derived automatically as soon as the modem has been registeredand the network provider has been found in our database. Otherwise, it will be required to configurethe following settings:

Phone number The phone number to be dialed, for 3G+ connections this commonly refersto be *99***1#. For circuit switched 2G connections you can enter the fixedphone number to be dialed in the international format (e.g. +420xx).

Access point name The access point name (APN) being used

Authentication The authentication scheme being used, if required this can be PAP or/andCHAP

Username The username used for authentication

Password The password used for authentication

Further on, you may configure the following advanced settings:

Required signal strength The minimum required signal strength before the connection isdialed.

Home network only Determines whether the connection should only be dialed whenregistered to the home network.

Negotiate DNS Specifies whether the DNS negotiation should be performed andthe retrieved name-servers should be applied to the system.

Call to ISDN This option must be enabled in case of 2G connections talking toan ISDN modem.


Web Configuration

Header compression Enables or disables Van Jacobson TCP/IP Header Compressionfor PPP-based connections. This feature will improve TCP/IP per-formance over slow serial links. Has to be supported by your pro-vider.

Data compression Enables or disables the data compression for PPP-based connec-tions. Data compression reduces the packet size to improvethroughput. Has to be supported by your provider.

Client address Specifies a fixed client IP address on the mobile interface.

MTU The Maximum Transmission Unit represents the largest amount ofdata that can be transmitted within one IP packet and can be definedfor any WAN interface.

7.2.4. USB

Administration

Enable or disable the USB administration. If enabled, any supported USB converter can be attachedand configured for example as another serial link (RS232, see Section 7.2.5, “Serial Port”).

Note

Supported modules are pl2303, ch341 and ftdi (quad-channel adapter).

Following parameters can be configured:

• Enable hotplug (always enabled)• Enable USB/IP device server

The USB/IP Device server can be used for the communication between the unit and the USB devicevia IP. This is being accomplished by tunneling the USB protocol over IP. The required USB/IPenumerator (Windows application) for accessing the USB stick from the computer can be providedto you on demand.

Click on the Refresh button in the tab Devices for displaying connected USB devices and add themwith by clicking on the plus sign.


Web Configuration

Autorun

This feature can be used to automatically perform a software/config update as soon as an USB storagestick has been plugged in. Following files must exist in the root directory of a FAT16/32 formatted stick:

• For authentication: autorun.key

• For a software update: sw-update.img

• For a configuration update: cfg-<SERIALNO>.zip or cfg.zip

Enable auto run feature: Enable or disable auto run feature.

The autorun.key file must hold valid access keys to perform any actions when the storage deviceis plugged in. The keys are made up of your admin password. They can be generated and downloaded.You may also define multiple keys in this file (line-after-line) in case your admin password differs ifapplied to multiple M!DGE/MG102i routers.


Web Configuration

7.2.5. Serial Port

The serial protocol can function in various ways, configure it using the Edit button on the right. If theUSB Administration is enabled, an extra SERIAL2 (USB) is available.

Five possibilities are available:

None The serial port is not used at all.

Login console A possibility to control the unit via the CLI commands when connected to theserial port (115200 8N1). There are no extra configuration parameters.

Device server Use this option to control the serial device via IP (transmit the data over thecellular network, ...). See the details below.

Protocol server Special implementation of various serial protocols like Modbus, IEC101, DNP3, ...See the details below.

SDK This option enables controlling the serial interface via the SDK scripts (similarto C programming). See chapter SDK for more details.


Web Configuration

Device Server

Serial Port Settings: Configure the required RS232 parameters.

Physical protocol: Only RS232 is supported.

Baud rate: Specifies the baud rate of the COMport.

Data bits: Specifies the number of data bits con-tained in each frame.

Parity: Specifies the parity used with everyframe that is transmitted or received.

Stop bits: Specifies the number of stop bits usedto indicate the end of a frame.

Software flow control: In XON/XOFF software flow control,either end can send a stop (XOFF) orstart (XON) character to the other endto control the rate of incoming data.

Hardware flow control: While 3 wired connection is used withM!DGE/MG102i hardware flow controlis not available.

Server Configuration: “Telnet” or “TCP raw”


Web Configuration

Protocol on IP port: “Telnet” or “TCP raw”

Port: The TCP port used by the applica-tion.

Timeout: Endless or numbered (in seconds).

Allow remote control (RFC 2217) Telnet with the RFC 2217 extension.

Show banner The option for displaying the bannerof the connected serial device.

Allow clients from The option for limiting the accessbased on the host IP address.

Important

The UDP Device Server functionality has been moved into SDK only. The required scriptfor this functionality can be provided on demand.

Protocol Server

The port settings configuration is the same as with the Device Server – the section called “DeviceServer”. Ignore the Server Configuration parameters, they do not have any effect. The protocol mustbe set in the Protocol Server menu.

Each SCADA protocol like Modbus, DNP3, IEC101, DF1 etc. has its unique message format, mostimportantly its unique way of addressing the remote units. The following text is valid for allM!DGE/MG102i/RipEX units (further in this the section called “Protocol Server” referred to as a "Unit")- the special properties for mobile GPRS/UMTS networks (e.g. limitation of broadcasting) are mentionedhere. The basic task for the protocol server is to check whether a received frame is within the protocolformat and is not corrupted. Most of the SCADA protocols are using some type of Error Detection Code(Checksum, CRC, LRC, BCC, etc.) for data integrity control, so each Unit calculates this code andchecks it against the received one.


Web Configuration

GPRS/UMTS mobile network operates in IP environment, so the basic task for the Protocol server isto convert SCADA serial packets to UDP datagrams. The Address translation settings are used todefine the destination IP address and UDP port. Then these UDP datagrams are sent to theM!DGE/MG102i router, processed there and are forwarded as unicasts through the mobile network totheir destination. When the gateway defined in the Routing table belongs to the Ethernet LAN, UDPdatagrams are instead forwarded to the Ethernet interface. After reaching the gateway, the datagramis forwarded according to the Routing table.

When the UDP datagram reaches its final IP destination, it should be in a M!DGE/MG102i or RipEXrouter again. It is processed further according to its UDP port. It can be delivered to the Protocol serverwhere where the datagram is decapsulated and the data received on the serial interface of the sourceunit are forwarded to COM. The UDP port can also be that of a Terminal server (RipEX) or any otherspecial protocol daemon on Ethernet like Modbus TCP etc. The datagram is then processed accordingto the respective settings.

Received frames on COM are closed when the gap between bytes is longer than the Idle value. Thisparameter defines the maximum gap (in milliseconds) in the received data stream. If the gap exceedsthis value, the link is considered idle, the received frame is closed and forwarded to the network.

The default Idle size differs based on the COM baud rate configuration. Remember that the default Idlesizes are set to the minimal possible values:

msbps12011520060576003038400201920010960054800524005120056005300

MRU (Maximum Reception Unit) – an incoming frame is closed at this size even if the stream of bytescontinues. Consequently, a permanent data stream coming to COM results in a sequence of MRU-sized frames sent over the network. The default value is set to 1600 bytes.

Both values are configurable only in the configuration file located at /etc/config/factory-config.cfg asthe following variables:

• rrsp.2.Rrsp2Main_v1.0.COM_IDLE_SIZE=5• rrsp.2.Rrsp2Main_v1.0.COM_MTU=1600

Restart the rrsp2 daemon for changes to take effect (# /etc/init.d/rrsp2 restart).

Note

All timeouts in the parameters described below are derived from the time when the packetis sent into the COM driver, i.e. it includes the transfer time of the packet. Take this intoaccount especially when there is a low Baud rate set in the COM settings.


Web Configuration

Important

If configuring the Protocol server together with VPN tunnels, there are several extra stepswhich must be done. Please see the Application note, chapter 4.2 SCADA Protocols -public APN1 for the details.

Common parameters

The parameters described in this section are typical of most protocols.There is only a link to them in description of the respective Protocol.

Mode of Connected deviceList box: Master, SlaveDefault = MasterThe typical SCADA application follows the Master–Slave scheme where the structure of the messageis different for the Master and Slave SCADA units. Because of that, it is necessary to set which typeof SCADA unit is connected to the Unit.

Important

For the SCADA Master, set Master, for the SCADA Slave, set Slave.

• MasterTheSCADA Master always sends addressed messages to Slaves. Addressing is different for eachSCADA protocol, so this is one of the main reasons why an individual Protocol server in each Unitfor each SCADA protocol has to be used. Broadcast

List box: On, OffDefault = OffSome Master SCADA units send broadcast messages to all Slave units. SCADA applicationstypically use a specific address for such messages. RipEX (Protocol utility) converts such mes-sages into a customized IP broadcast and broadcasts it to all RipEX units resp. to all SCADAunits within the network.

Note

Broadcasts in the GPRS/UMTS network are not possible, thus setting of broadcastfunctionality is not allowed with M!DGE/MG102i units.

If On, the address for broadcast packets in the SCADA protocol has to be defined: Broadcast address format - List box Hex, Dec - format in which the broadcast address is

defined. Broadcast address - address in the defined format (Hex, Dec)

Address translationList box: Table, MaskDefault = MaskIn a SCADA protocol, each SCADA unit has a unique address, a "Protocol address". In aGPRS/UMTS mobile network, each SCADA unit is represented by an IP address (typically thatof the ETH interface) and a UDP port (that of the protocol daemon or the COM port server towhich the SCADA device is connected via serial interface).A translation between the "Protocol address" and the IP address & UDP port pair has to bedone. It can be done either via Table or Mask.

1 http://www.racom.eu/eng/products/m/midge/app/SCADA_Serial_Protocols.html#SCADA_Protocols_public_APN


Web Configuration

http://www.racom.eu/eng/products/m/midge/app/SCADA_Serial_Protocols.html#SCADA_Protocols_public_APN

http://www.racom.eu/eng/products/m/midge/app/SCADA_Serial_Protocols.html#SCADA_Protocols_public_APN

Hence, a SCADA message received from the serial interface is encapsulated into a UDP/IPdatagram, where the destination IP address and the destination UDP port are defined accordingto the settings of the Address translation. Mask

Translation using the Mask is simpler to set, however it has some limitations:− all IP addresses used have to be within the same network, which is defined by this Mask−the same UDP port is used for all the SCADA units, which results in the following:

− SCADA devices on all sites have to be connected to the same interface− only one SCADA device can be connected to one COM port

• Base IPDefault = IP address of the ETH interfaceWhen creating the IP destination address of UDP datagram, in which the serial SCADAmessage received from COM is encapsulated, thi is created, this Base IP is taken as thebasis and only the part defined by the Mask is replaced by the 'Protocol address'.

• MaskDefault = 255.255.255.0A part of the Base IP address defined by this Mask is replaced by the 'Protocol address'.The SCADA protocol address is typically 1 byte, so Mask 255.255.255.0 is most frequentlyused.

• UDP port (Interface)List box: COM, ManualThis UDP port is used as the destination UDP port in the UDP datagram in which theserial SCADA packet received from COM1 is encapsulated. The default UDP port forCOM can be used or the UDP port can be set manually. If the destination IP addressbelongs to a Unit and the UDP port is not assigned to COM (COM1(2) or to a Terminalserver in case of RipEX) or to any special daemon running in the destination address,the packet is discarded.

Note

M!DGE/MG102i use UDP port 8882 for its COM port.

TableThe Address translation is defined in a table. There are no limitations such as when the Masktranslation is used. If there are more SCADA units on the RS485 (e.g. with RipEX COM2)their interface, their “Protocol addresses” should be translated to the same IP address andUDP port pair, where the multiple SCADA units are connected. There are 3 possibilities howto fill in the line in the table:− One "Protocol address" to one "IP address" (e.g.: 56 −−> 192.168.20.20)− Range of "Protocol addresses" to one "IP address" (e.g.: 56 – 62 ===> 192.168.20.20)− Range of "Protocol addresses" to range of "IP addresses" (e.g.: 56 – 62 ===> 192.168.20.20– 26). One option is to write only the start IP and a dash, the system will add the end addressitself.• Protocol address

This is the address which is used by the SCADA protocol. It may be set either in Hexa-decimal or Decimal format according to the List box value.Protocol address length can be 1 byte, but for the DNP3 and UNI protocols support 2bytes addresses.

• IPThe IP address to which Protocol address will be translated. This IP address is used asthe destination IP address in the UDP datagram in which serial SCADA packet receivedfrom COM is encapsulated.


Web Configuration

• UDP port (Interface)This is the UDP port number which is used as the destination UDP port in the UDP data-gram in which the serial SCADA message, received from COM, is encapsulated.

• NoteYou may add a note to each address up to 16 characters long for your convenience. (E.g.“Remote unit #1”).

• ActiveYou may tick/un-tick each translation line in order to make it active/not active.

• ModifyEdit, Delete Add buttons allow to edit or to add or to delete a line. The lines can be sortedusing up and down arrows.

• SlaveThe SCADA Slave typically only responds to Master requests, however in some SCADA protocolsit can communicate spontaneously.Messages from the serial interface are processed in a similar way as the Master site, i.e. they areencapsulated in UDP datagrams, processed by the router inside the M!DGE/MG102i unit and for-warded to the respective interface, typically to the mobile network. Broadcast accept

List box: On, OffDefault = OffIf On, broadcast messages from the Master SCADA device to all Slave units are accepted andsent to connected Slave SCADA unit.

Important

Broadcasting is not supported with mobile networks.

PROTOCOLS IMPLEMENTED:

None

All received frames from the COM port as well as from the network are discarded.

Async link

The async link creates asynchronous link between two COM ports on different Units. Received framesfrom COM are sent without any processing transparently to the mobile network to set the IP destinationand UDP port. Received frames from the mobile network are sent to the respective COM according tothe UDP port setting.

• Parameters Destination IP

This is the IP address of the destination Unit. UDP port (Interface)

This is the UDP port number which is used as the destination UDP port in the UDP datagramin which the packet received from COM is encapsulated.

C24

C24 is a serial polling-type communication protocol used in Master–Slave applications.


Web Configuration

Multiple C24 Masters can be used within one network and one Slave can be polled by more than oneMaster.

Underlined parameters are described in Common parameters.

Mode of Connected deviceMaster

Address translationTableMask

Slave

• Protocol framesList box: 1C, 2C, 3C, 4CDefault = 1COne of the possible C24 Protocol frames can be selected.

• Frames formatList box: Format1, Format2, Format3, Format4, Format5Default = Format1One of the possible C24 Frames formats can be selected. According to the C24 protocol specification,it is possible to set Frames formats 1–4 for Protocol frames 1C–3C and formats 1–5 for 4C.

Important

The Unit accepts only the set Protocol frames and Frames format combination. All othercombinations frames are discarded by the Unit and not passed to the application.

• Local ACKList box: Off, OnDefault = OffAvailable for Protocol frame 1C only. When On, ACK on COM is send locally from this unit, not overthe mobile network.

Cactus

Cactus is a serial polling-type communication protocol used in Master–Slave applications.Multiple Cactus Masters can be used within one network and one Slave can be polled by more thanone Master.



BroadcastNote: There is no the possibility to set Broadcast address, sinceCactus broadcast messages always have the address 0x00. Hencewhen the Broadcast is On, packets with this destination are handledas broadcasts. Broadcasting is not supported with mobile networks.Address translation


Web Configuration

TableMask

SlaveBroadcast accept

• Max gap timeout [ms]Default = 30The longest time gap for which a frame can be interrupted and still received successfully as oneframe. It should not be set below 10ms, while 15–40 ms should be OK for a typical Cactus protocoldevice.

Comli

Comli is a serial polling-type communication protocol used by Master–Slave applications.More Comli Masters can be used within one network and one Slave can be polled by more Masters.Broadcasts packets are not used, so the configuration is using only some parameters described inCommon parameters.



Slave

DF1

Only the full-duplex mode of DF1 is supported. Each frame in the Allen-Bradley DF1 protocol containsthe source and destination addresses in its header, so there is no difference between Master and Slavein the full-duplex mode in terms of Unit configuration.

• Block control modeList box: BCC, CRCDefault = BCCAccording to the DF1 specification, either BCC or CRC for Block control mode (data integrity) canbe used.

• BroadcastAccording to the DF1 specification, packets for the destination address 0xFF are consideredbroadcasts. Broadcasts are not supported with the mobile network.


• Advanced parameters ACK Locally

List box: Off, OnDefault = OnIf "On", ACK frames (0x1006) are not transferred over-the-air.


Web Configuration

When the Unit receives a data frame from the connected device, it generates the ACK frame(0x1006) locally. When the Unit receives the data frame from the mobile network, it sends theframe to the connected device and waits for the ACK. If the ACK is not received within 1 sec.timeout, Unit sends ENQ (0x1005). ENQ and ACK are not generated for broadcast packets.

DNP3

Each frame in the DNP3 protocol contains the source and destination addresses in its header, so thereis no difference between Master and Slave in terms of the M!DGE/MG102i configuration. The DNP3allows both Master–Slave polling as well as spontaneous communication from remote units.

• Broadcast - Note: There is not the option to set the Broadcast address, since DNP3 broadcastmessages always have addresses in the range 0xFFFD – 0xFFFF. Broadcasting is not supportedby mobile networks, thus it is not possible to set the broadcast to On..


IEC 870-5-101

IEC 870-5-101 is a serial polling-type communication protocol used by Master–Slave application.More IEC 870-5-101 Masters can be used within one network and one Slave can be polled by moreMasters.IEC 870-5-101 protocol configuration is using all parameters described in Common parameters.


Broadcast - only On, Off. Protocol broadcast address is not configurable, it is definedby Address mode in Advance parameter (default 0xFF), but broadcasting is not al-lowed within mobile networks.Address translation

TableMask


• Advanced parameters Address mode

Even if IEC 870-5-101 is the standard, there are some users who have customized this standardaccording to their needs. If addressed byte has been moved, M!DGE/MG102i/RipEX has to readit at the correct frame position. IEC101

Address byte location according to IEC 870-5-101 standard.Broadcast from Master station is generated when address byte is 0xFF.

2B ADDRTwo byte address (IEC 870-5-101 standard is 1 byte). The frame is 1 byte longer than thestandard one. There is the Intel sequence of bytes: low byte, high byte. Mask Addresstranslation has to be used, because Table one is limited to just one byte address length.


Web Configuration

The Master station broadcast is generated when the low address byte is 0xFF and high ad-dress byte is also 0xFF.

TELEGYRThe Control byte in the standard IEC packet is omitted. The frame is 1 byte shorter than astandard one. This is typically used in the Telegyr 805/809 protocol.Broadcast from Master station broadcast is generated when the address byte is 0x00.

SINAUTThe sequence of Address byte and Control byte in the frame is swapped-over.Master station broadcast is generated when the address byte is 0x00.

ITT Flygt

ITT Flygt is a serial polling-type communication protocol used in Master–Slave applications.

ITT Flygt protocol configuration uses all parameters described in Common parameters.


BroadcastNote: There is no possibility to set the Broadcast address, since ITT Flygtbroadcast messages always have the address 0xFFFF. Hence when theBroadcast is On, packets with this destination are handled as broadcasts.Broadcasting is not available with mobile GPRS/UMTS networks.

• First Slave AddressDefault = 1Slave addresses are not defined in the ITT Flygt protocol. HoweverSlave addresses have to be defined in the Unit network. This is the FirstSlave address in decimal format.

• Number of SlavesDefault = 1Since the ITT Flygt protocol Master (centre) polls the Slaves (remotes)one by one without any addressing, the number of Slaves has to bedefined.



• Wait timeout [ms]Default = 5000An ITT Flygt Slave sometimes sends the WAIT COMMAND (0x13) to its Master. The Unit does notaccept the next WAIT COMMAND (discards it), till the Wait timeout expires. The Recommendedvalue is in the 1–10 seconds range.

Modbus

Modbus RTU is a serial polling-type communication protocol used by Master–Slave application.


Web Configuration

More Modbus Masters can be used within one network and one Slave can be polled by more Masters.Modbus protocol configuration uses all parameters described in Common parameters.


BroadcastAddress translation

TableMask


Profibus

RipEX supports Profibus DP (Process Field Bus, Decentralized Periphery) the widest-spread versionof Profibus. The Profibus DP is supported even by M!DGE/MG102i, but it will work satisfactorily onlywith mobile networks with very short transport delays, like LTE or UMTS. The Profibus protocol config-uration uses all parameters described in Common parameters.



TableMask


RP570

RP570 is a serial polling-type communication protocol used in Master–Slave applications.

Multiple RP570 Masters can be used within one network and one Slave can be polled by more thanone Master.



• Local simulation RBList box: Off, OnDefault = OffThe RP570 protocol Master very often transmits the RB packets (hold packets) solely to checkwhether Slaves are connected. In order to minimize the mobile network payload, the Unit can beconfigured to respond to these packets locally and not to transmit them to the Slaves over the mobilenetwork.


Web Configuration

If On, the Unit responds to RB packets received from the RP 570 master locally over the COM in-terface. However from time to time (RB period) the RB packets are transferred over the network inorder to check whether the respective Slave is still on. When the RB response from the Slave tothis RB packet is not received over the mobile network within the set RB timeout, i.e. the respectiveSlave is out of order, the central Unit stops local answering to RB packets from the master for therespective Slave.

• RB Net period [s]Default = 10The M!DGE/MG102i/RipEX responds to the RB packets locally and in the set RB period the RBpackets are transferred over the network.

• RB Net timeout [s]Default = 10 (maximum=8190)Whenever an RB packet is sent over the network, the set RB Net timeout starts. When the RB re-sponse from the remote unit (Slave) is not received within the timeout, i.e. the respective Slave isout of order, the central Unit stops the local answering to RB packets from the master for the re-spective Slave.


Slave

Slave

• Local simulation RBList box: Off, OnDefault = OffThe RP570 Slave expects to receive RB packets from the Master. When the Local simulation RBon the Master is On, the RB packets are transferred over the mobile network only in the RB Netperiod (see the Master settings). The Local simulation RB has to be set the same (On or Off) on allsites in the network, i.e. on the master as well as all Slaves.

If On, the Unit generates RB packets locally and transmits them over the COM interface in the RBRequest period and expects the RB response for each RB packet from the RP570 Slave within theRB Response timeout. When the Unit does not receive the response(s) from the RP570 Slave, theUnit does not respond to the RB packet from the Master, which it receives over the mobile networks.

• RB Request period [ms]Default = 200 (maximum=8190)M!DGE/MG102i/RipEX sends locally RB packets to the connected RTU in the set period.

• RB Response timeout [ms]Default = 500 (maximum=8190)The Unit expects a response to the RB packet within the set timeout. If it is not received, the Unitdoes not respond to RB packets from the Master received over the mobile network.

• RTU address (Hex)Default = 01


Web Configuration

Active only when the Local simulation RB is On. The connected RTU’s address is supposed to befilled in. This address (0x00-0xFF) is used in the RB packets generated locally in theM!DGE/MG102i/RipEX and transmitted over the COM.

Siemens 3964(R)

The 3964 protocol is utilized by the Siemens Company as a Point-to-Point connection between twocontrollers. Meanwhile it has become an industry standard that can be found on many devices as auniversal communications interface. 3964R is the same as 3964, in addition it only uses BCC (BlockCheck Character). 3964(R) handle only the link layer (L2 in OSI model), hence Unit uses a similar wayto read “SCADA address” as in UNI protocol.

There is a handshake STX(0x02) – DLE(Ox10) at the start of communication and DLE+ETX – DLE atthe end. This handshake is performed by RipEX locally, it is not transferred over the RipEX network.

Communication goes as follows:LocalRTU→STX→LocalRipexLocalRipex→DLE→LocalRTULocalRTU→DATA+DLE+ETX+BCC→LocalRipexLocalRipex→DATA→RemoteRipex*LocalRipex→DLE→LocalRTURemoteRipex→STX→RemoteRTURemoteRTU→DLE→RemoteRipexRemoteRipex→DATA+DLE+ETX+BCC→RemoteRTURemoteRTU→DLE→RemoteRipex

* only this packet is transferred over the RipEX network, all the other ones are handled locally.


Mode of Connected deviceMaster• Address mode

List box: Binary (1 B), Binary (2B LSB first). Binary (2B MSB first).Default = Binary (1 B)M!DGE/MG102i/RipEX reads the Protocol address in the format andlength set (in bytes).

• Address positionSpecify the sequence number of the byte, where the Protocol addressstarts.

Note 1: 3964(R) protocol uses an escape sequence (control sequence)for DLE (0x10), i.e. when 0x10 is in user data, 0x1010 is sent instead.When the address position is calculated, the bytes added by the escapesequence algorithm are not taken into account.

Note 2: The first byte in the packet has the sequence number 1, not 0.


Table


Web Configuration

MaskSlave

Broadcast accept

• DLE timeout [ms]Default = 1000 (min. 300, max. 8190)

M!DGE/MG102i/RipEX expects a response (DLE) from the connected device (RTU) within the settimeout. If it is not received, the Unit repeats the frame according to the “Retries” setting.

• Retries [No]Default = 3 (min. 0, max. 7)

When DLE timeout is „On“, and the DLE packet is not received from the connected device (RTU)within the set DLE timeout, the Unit retransmits the frame. The number of possible retries is specified.

• PriorityList box: Low, HighDefault = Low

When the equipment sends STX and receives STX instead of DLE, there is a collision, both deviceswant to start communication. In such a case, one unit has to have priority. If the Priority is High, theUnit waits for DLE. When it is Low, the Unit send DLE.

Note: Obviously, two devices which are communicating together must be set so that one has Highpriority and the other has Low.

• BCCList box: On, OffDefault = On

BCC (Block Check Character) is a control byte used for data integrity control, it makes the reliabilityhigher. BCC is used by 3964R, 3964 does not use it.

The unit checks (calculates itself) this byte while receiving a packet on COM. Unit transmits DLE(accepts the frame) only when the check result is OK. The BCC byte is not transferred over thenetwork, it is calculated locally in the end Unit and appended to the received data.

UNI

UNI is the "Universal" protocol utility designed by RACOM. It is supposed to be used when the applic-ation protocol is not in the Unit list. The key condition is that messages generated by the Master applic-ation device always contain the respective Slave address and that address (or its relevant part) position,relative to the beginning of the message (packet, frame), is always the same (Address position).

Generally two communication modes are typical for the UNI protocol: In the first one, communicationalways has to be initiated by the Master and only one response to a request is supported; in the secondmode, Master-Master communication or combination of UNI protocol with ASYNC LINK protocol andspontaneous packet generation on remote sites are possible.

The UNI protocol is fully transparent, i.e. all messages are transported and delivered in full, withoutany modifications.



Web Configuration

Mode of Connected deviceMaster• Address mode

List box: Binary (1 B), ASCII (2 B), Binary (2B LSB first). Binary (2BMSB first).Default = Binary (1 B)M!DGE/MG102i/RipEX reads the Protocol address in the format andlength set (in bytes).

The ASCII 2-byte format is read as 2-character hexadecimal represent-ation of one-byte value. E.g. ASCII characters AB are read as 0xABhex (10101011 binary, 171 decimal) value.

• Address positionSpecify the sequence number of the byte, where the Protocol addressstarts. Note that the first byte in the packet has the sequence number1, not 0.

• Address mask (Hex)When the Address mode is Binary 2 bytes, a 16-bit value is read fromthe SCADA protocol message according to the Address mode setting(either the MSB or the LSB first), The resulting value is then bit-maskedby the Address mask and used as the input value for SCADA to IP ad-dress translation (e.g. via a table). The default value of the Addressmask is 0xFFFF, hence the full 16-bit value is used by default.

Example:The Address mode is set to Binary (2B LSB first), the Address mask isset to 7FF0 and the Address position is set to 2. The SCADA messagestarts with bytes (in hex) 02 DA 92 C3 .. The 2-byte address is read as0x92DA (note the LSB came first in the message), Then 0x7FF0 maskis applied and the resulting value 0x12D0 (0x92DA & 0x7FF0) is usedas the input for the translation.

• Poll response controlList box: On, OffDefault = On

On – The Master accepts only one response per request and it mustcome from the the specific remote to which the request was sent. Allother packets are discarded. This applies to the Master–Slave commu-nication scheme.

Note: It may happen, that a response from a Slave (No.1) is deliveredafter the respective timeout expired and the Master generates the re-quest for the next Slave (No.2) in the meantime. In such a case thedelayed response from No.1 would have been considered as the re-sponse from No.2. When Poll response control is On, the delayed re-sponse from the Slave No.1 is discarded and the Master stays readyfor the response from No.2.

Off – The Master does not check packets incoming from the mobilenetwork - all packets are passed to the application. That allows e.g.spontaneous packets to be generated at remote sites. This mode is


Web Configuration

suitable for the Master–Master communication scheme or a combinationof the UNI and ASYNC LINK protocols.


TableMask


7.2.6. Digital I/O

The Digital I/O page displays the current status of the I/O ports and can be used to turn output portson or off.

You can apply the following settings:

Besides on and off you may keep the status after reboot at default which corresponds to the defaultstate as the hardware will be initialized at power-up.

The digital inputs and outputs can also be monitored and controlled by SDK scripts.


Web Configuration

7.3. ROUTING

7.3.1. Static Routes

This menu shows all routing entries of the system, which can consist of active and configured ones.(Netmasks can be specified in CIDR notation, e.g. 24 expands to 255.255.255.0).

Destination: Destination network or host provided by IP addresses in dotted decimal.

Netmask: Subnet mask which forms, in combination with the destination, the network to beaddressed. A single host can be specified by a netmask of 255.255.255.255, adefault route corresponds to 0.0.0.0.

Gateway: The next hop which operates as gateway for this network (can be omitted on peer-to-peer links).

Interface: Network interface on which a packet will be transmitted in order to reach the gatewayor network behind.

Metric: The routing metric of the interface (default 0). The routing metric is used by routingprotocols, higher metrics have the effect of making a route less favourable; metricsare counted as additional costs to the destination network.

Flags: (A)ctive, (P)ersistent, (H)ost Route, (N)etwork Route, (D)efault Route

The flags obtain the following meanings:

Active The route is considered active, it might be inactive if the interfacefor this route is not yet up

Persistent The route is persistent, which means it is a configured route,otherwise it corresponds to an interface route

Host The route is a host route, typically the netmask is set to255.255.255.255.

Network The route is a network route, consisting of an address and net-mask which forms the subnet to be addressed


Web Configuration

Default Route The route is a default route, address and netmask are set to0.0.0.0, thus matching any packet

You can check the corresponding routing via the "Route lookup" functionality. Just fill in the desired IPaddress and click on the "Lookup" button. The detailed information about the chosen route will be dis-played.

Note

The maximum number of manual static routes is 10. This number can be increased to 30with a SERVER licence.

7.3.2. Extended Routes

Extended routes can be used to perform policy-based routing, they generally precede static routes.

Extended routes can be made up not only of a destination address/netmask but also a source ad-dress/netmask, incoming interface and the type of service (TOS) of packets.

Incoming interface The interface on which the packet enters the system

Source address The packet source address

Source netmask The packet source netmask

Destination address The packet destination address


Web Configuration

Destination netmask The packet destination netmask

Protocol Protocol used (ANY, UDP or TCP)

Type of service The TOS value within the packet header

Route to Specifies the target interface or gateway to where the packet should getrouted to.

Type of Service The ToS value within the packet header (possible values are ignore, normal-service (0), minimize-cost (2), maximize-reliability (4), maximize-throughput(8), minimize-delay (16))

7.3.3. Multipath Routes

Multipath routes perform weighted IP-session distribution for particular subnets across multiple interfaces.

At least two interfaces must be defined to establish the Multipath routing. Additional interfaces can beadded by pressing the "plus" sign.

Target network/netmask The target network for which the Multipath routing will be applied

Interface The interface for the selected path

Weight Interface weight in relation to the others (e.g. values 4 and 1 for twopaths will result in 80 and 20 % of distribution)

Nexthop Nexthop address to be used as a default gateway for the selected in-terface

7.3.4. Mobile IP

Mobile IP (MIP) can be used to enable a seamless switch between different WAN technologies.


Web Configuration

Note

A valid license key is required for running Mobile IP.

It boasts with very small outages during switchover while keeping all IP sessions alive which is beingaccomplished by communicating with the static public IP address of a home agent which will encapsulatethe packets and send them further to the router. Switching works by telling the home agent that thehotlink address has changed, the agent will then re-route (that means encapsulate the packets withthe new target address) the packets transparently down to the box.

Our implementation supports RFC 3344, 5177, 3024 and 3519 and interoperability with Cisco has beenverified. However, M!DGE/MG102i routers can run as node and home agent which makes them ableto replace expensive kits in the backbone for smaller scenarios.

If MIP is run as the Mobile node, the following settings can be configured:

Primary home agent address: The address of the primary home agent

Secondary home agent address: The address of the secondary (fallback) home agent

Home address: The permanent home address of the node which can be used toaddress the box

SPI: The Security Parameter Index (SPI) identifying the security contextbetween a pair of nodes (represented in 8 chars hex)

Authentication type: The used authentication, can be prefix-suffix-md5 or hmac-md5


Web Configuration

Shared secret: The shared secret used for authentication, can be a 128-bit hex orASCII string

Life time: The lifetime of security associations in seconds

MTU: Maximum transmission unit in bytes

UDP encapsulation: Specifies whether UDP encapsulation shall be used

Mobile network address: Optionally specifies a subnet which should be routed to the box

Mobile network mask: The netmask for the optional routed network

If MIP is run as home agent, you will have to set up a home address and netmask first and configurevarious nodes afterwards which are made up of the following settings:

SPI The home address of the network

Authentication type The mask for the home network.

Shared secret The shared secret used for the mobile node authentication at the homeagent. This can be either a 128-bit hexadecimal value or a random lengthASCII string.


Web Configuration

7.3.5. Quality of Service (QoS)

M!DGE/MG102i routers are able to prioritize and shape certain kinds of IP traffic. This is currently limitedon egress, which means that only outgoing traffic can be stipulated. The current QoS implementationuses Stochastic Fairness Queueing (SFQ) classes in combination with Hierarchy Token Bucket (HTB)queuing disciplines. In case of demands for other classes or qdiscs, please contact our support teamin order to evaluate the best approach for your application.

QoS Administration The administration page can be used to enable and disable QoS.

QoS Classification The classification section can be used to define the WAN interfaces on whichQoS should be active.

Interface: The WAN interface on which QoS should beactive.

Bandwidth congestion: The bandwidth congestion method. In caseof the auto option, the system will try to applylimits in a best-effort way. However, it issuggested to set fixed bandwidth limits asthey also offer a way of tuning the QoS beha-viour.

Downstream bandwidth: The available bandwidth for incoming traffic.

Upstream bandwidth: The available bandwidth for outgoing traffic.

When defining limits, you should consider bandwidth limits which are at least possible as most shapingand queues algorithms will not work correctly if the specified limits cannot be achieved. In particular,any WWAN interfaces operating in a mobile environment are suffering variable bandwidths, thus ratherlower values should be used.


Web Configuration

In case an interface has been activated, the system will automatically create the following queues:

high: A high priority queue which may hold any latency-critical services (such as VoIP).

default: A default queue which will handle all other services.

low: A low priority queue which may hold less-critical services for which shaping is intended.

Each queue can be configured as follows:

Name: The name of the QoS queue.

Priority: A numerical priority for the queue, lower values indicate higher priorities.

Bandwidth: The maximum possible bandwidth for this queue.


Web Configuration

You can now configure and assign any services to each queue. The following parameters apply:

Interface: The QoS interface of the queue

Queue: The QoS queue to which this service shall be assigned

Source: Specifies a network address and netmask used to match the source addressof packets

Destination: Specifies a network address and netmask used to match the destination (target)address of packets

Protocol: Specifies the protocol for packets to be matched

Type of Service: Specifies the ToS/DiffServ for packets to be matched

7.4. FIREWALL

This router uses Linux’s netfilter/iptables firewall framework (see http://www.netfilter.org for more in-formation). It is set up of a range of rules which control each packet’s permission to pass the router.Packets, not matching any of the rules, are allowed by default.

7.4.1. Firewall

Administration

The administration page can be used to enable and disable firewalling. When turning it on, a shortcutcan be used to generate a predefined set of rules which allow administration (over HTTP, HTTPS, SSHor TELNET) by default but block any other packets coming from the WAN interface. Please note that


Web Configuration

the specified rules are processed by order, that means, traversing the list from top to bottom until amatching rule is found. If there is no matching rule found, the packet is allowed.

Administrative status: Enable or disable packet filtering.

Allow WAN administration: This option will predefine the rules for services on the WAN link asfollows (TCP ports 80, 443, 22 and 23):

Address / Port Groups

This menu can be used to form address or port groups which can be later used for firewall rules in orderto reduce the number of rules.


Web Configuration

Add Firewall Rule

Description: A meaningful description about the purpose of this rule.

Mode: Whether the packets of this rule should be allowed or denied.

Incoming interface: The Interface on which matching packets are received.

Outgoing interface: The interface on which matching packets are received.

Source: Source address of matching packets. Possible values are "ANY", "LOCAL"(addressed to the system itself), "Group" or "Specify" (specified by anaddress/netmask).

Destination: The destination address of matching packets, can be "ANY", "LOCAL"(addressed ... itself), "Group" or "Specify (specified by address/netmask).

Protocol: Used IP protocol of matching packets.

Destination port(s): Destination port of matching packets. You can specify a single port or arange of ports here. Note that protocol must be set to UDP/TCP whenusing port filters.

Transparent Firewall

M!DGE/MG102i can be configured with its Ethernet interfaces being bridged. In this case, the transparentfirewall functionality can be configured to limit reachability of individual hosts connected toM!DGE/MG102i based on their MAC addresses, i.e. units connected to ETH1 cannot communicate tounits connected to ETH2.


Web Configuration

7.4.2. NAPT

This page allows setting of the options for Network Address and Port Translation (NAPT). NAPTtranslates IP addresses or TCP/UDP ports and enables communication between hosts on a privatenetwork and hosts on a public network. It generally allows a single public IP address to be used bymany hosts from the private LAN network.

Administration

This menu can be used to configure the interfaces on which outgoing NAT will be performed.

Inbound Rules

Inbound rules can be used to modify the target section of IP packets and, for instance, forward a serviceor port to an internal host. By doing so, they will expose the service and make it reachable e.g. fromthe Internet. You may also establish 1:1 NAT to a complete host.


Web Configuration

Description: A meaningful rule description

Incoming interface: Interface from which matching packets are received

Map: Choosing whether the rule applies to the host or to the network.

Target address: Destination address of matching packets (optional)

Target port(s): Used UDP/TCP port range of matching packets

Redirect to: Address or network/netmask to which matching packets will be redirected

Redirect port: Port to which matching packets will be targeted

Outbound Rules

Outbound rules will modify the source section of IP packets and can be for instance used for 1:1 NAT.

Description: A meaningful description of this rule


Web Configuration

Map: Choosing whether the rule applies to the host or to the network.

Outging interface: Outgoing interface on which matching packets are leaving the router

Source address/ports: Source address/ports of matching packets (if Map is set to "host")

Source network/netmask: Source network/netmask of matching packets (if Map is set to"network")

Rewrite to address/port: Address/port to which the source address/port of matching packetswill be rewritten to

Rewrite to network/netmask: Network/netmask to which the source network/netmask of matchingpackets will be rewritten to


Web Configuration

7.5. VPN

7.5.1. OpenVPN

Administration

OpenVPN administrative status: Enable or disable OpenVPN.

Restart on link change: If checked, the tunnel is restarted whenever any link changes thestatus.

If enabled, OpenVPN client configurations will be started whenever a WAN link has been established.Server configuration will be started immediately after after the bootup.

Tunnel Configuration

The router supports a single server tunnel and up to 4 client tunnels. You can specify tunnel parametersin standard configuration or upload an expert mode file which has been created in advance. Refer tosection the section called “Client Management” to learn more about how to manage clients and generatethe files.

Operation mode: Choose the client or server mode for this tunnel

Note

M!DGE/MG102i can be running up to 4 OpenVPN tunnels in the Client mode, but only onetunnel in the Server mode.


Web Configuration

Client Mode

Peer selection: Specifies how the remote peer shall be selected, besides a single server youmay configure multiple servers which can , in case of failures, either be selec-ted sequentially (i.e. failover) or randomly (i.e. load balancing).

Server The remote server address or hostname

Port The remote server port (1194 by default)

Encapsulation: The VPN device type which can be either TUN (typically used for routedconnections) or TAP (used for bridged networks)

Protocol: The OpenVPN tunnel protocol to be used.

Network mode: Defines how the packets should be forwarded, can be routed or bridged fromor to a particular interface. You can also set the MTU for the tunnel.

Authentication: You can choose between credential-based (where you have to specify ausername and password) and certificate-based options. Note that keys/certi-ficates have to be created in the SYSTEM -> Keys & Certificates menu. Youmay also upload files which you have generated on your host system.

HMAC digest: HMAC is commonly used message authentication algorithm (MAC) that usesa data string, a secure has algorithm, and a key, to produce a digital signature.OpenVPN's HMAC usage is to first encrypt a packet, then HMAC the resultingciphertext. If OpenVPN receives a packet with a bad HMAC, it drops thispacket. HMAC usually adds 16 or 20 Bytes per packet.


Web Configuration

Encryption: Required cipher mechanism used for encryption.

Use compression: Enable or disable OpenVPN compression.

Use keepalive: Can be used to send a periodic keep alive packet in order to keep the tunnelup despite inactivity.

Redirect gateway: By redirecting the gateway, all packets will be directed to the VPN tunnel.Please ensure that essential services (such as DNS or NTP servers) can bereached via the network behind the tunnel. If in doubt, create an extra staticroute pointing to the correct interface.

Server Mode

A server tunnel typically requires the following files:

• server.conf (OpenVPN configuration file),

• ca.crt (root certificate file),

• server.crt (certificate file),

• server.key (private key file),

• dh1024.pem (Diffie Hellman parameters file),

• a directory (with default name “ccd”) containing client-specific configuration files.


Web Configuration

Important

OpenVPN tunnels require a correct system time. Please ensure that all NTP servers arereachable. When using host names, a working DNS server is required as well.

Client Management

Once you have successfully set up an OpenVPN server tunnel you can manage and enable clientswhich can connect to your service, the client’s page also informs you about currently connected clients.Further, you can specify a fixed tunnel endpoint address of each client and its network behind. Youcan also define routes to be pushed to each client if you want to redirect traffic for particular networkstowards the server and enable routing between clients.

Finally, you can generate and download all expert mode files to easily populate each client.

Note

The downloaded expert mode file needs to be unzipped and then individual client expertfiles can be uploaded to the respective routers.

Note

See the OpenVPN configuration example in our Application notes. (http://www.ra-com.eu/eng/products/m/midge/app/VPN_config.html#OpenVPN).

7.5.2. IPsec

IPsec is primarily used for securing the Internet communication by authenticating and/or encrypting IPpackets within a data stream. IPsec includes various cryptographic protocols and ciphers for key ex-


Web Configuration

http://www.racom.eu/eng/products/m/midge/app/VPN_config.html#OpenVPN

http://www.racom.eu/eng/products/m/midge/app/VPN_config.html#OpenVPN

change and data encryption and can be seen as one of the strongest VPN technologies in terms ofsecurity.

Administration

IPsec administrative status: Enable or disable IPsec

Propose NAT Traversal: NAT-Traversal is mainly used for connections which traverse a pathwhere a router modifies the IP address/port of packets

Restart on link change: If checked, the tunnel is restarted whenever any link changes thestatus.

Configuration

General

Remote Peer IP address: The IPsec peer/responder/server IP address or host name

Administrative status: Enable or disable Dead Peer Detection. DPD will detect any brokenIPSec connection, in particular the ISAKMP tunnel, and refresh thecorresponding SAs (Security Associations) and SPIs (Security Pay-load Identifiers) for a faster tunnel re-establishment.


Web Configuration

Detection cycle: Set the delay (in seconds) between Dead Peer Detection (RFC 3706)keepalives (R_U_THERE, R_U_THERE_ACK) that are sent for thisconnection (default 30 seconds)

Failure threshold: The number of unanswered DPD R_U_THERE requests until theIPsec peer is considered dead (the router will then try to re-establisha dead connection automatically)

Action: The action when a DPD enabled peer is declared dead. Hold (default)means the eroute is put into the hold status, while clear means theeroute and SA will both be cleared. Restart means that the SA willbe immediately renegotiated.

IKE Proposal

RACOM routers support IKE authentication via the pre-shared keys (PSK) or certificates within a publickey infrastructure.

Using PSK requires the following settings:

PSK: The pre-shared key used

Local ID Type: The identification type for the local router which can be FQDN,username@FQDN or IP address

Local ID: The local ID value


Web Configuration

Peer ID type: The identification type for the remote router

Peer ID: The peer ID value

Note

When using certificates you would need to specify theOperation mode. When run as the PKI client you cancreate a Certificate Signing Request (CSR) in the certi-ficates section which needs to be submitted at yourCertificate Authority and imported to the router after-wards. In the PKI server mode the router represents theCertificate Authority and issues the certificates for remotepeers.

Negotiation mode: Choose the negotiation mode (main, aggressive). The aggressivemode has to be used when dealing with dynamic endpoint ad-dresses, but it is referred to be less secure compared to the mainmode as it reveals your identity to an eavesdropper.

Encryption algorithm: The IKE encryption method (3DES, AES128, AES192, AES256)

Authentication algorithm: The IKE authentication method (MD5, SHA1, SHA2-256)

IKE Diffie-Hellman group: The IKE Diffie-Hellman group (2, 5)

SA life time: The Security Association lifetime

Perfect forward secrecy (PFS): This feature heavily increases security as PFS avoids penetrationof the key-exchange protocol and prevents compromising the keysnegotiated earlier.

IPsec Proposal

Encapsulation mode: Only the tunnel encapsulation mode is enabled

IPsec protocol: Only the ESP IPsec protocol is enabled


Web Configuration

Encryption algorithm: The IKE encryption method (3DES, AES128, AES192, AES256)

Authentication algorithm: The IKE authentication method (MD5, SHA1, SHA2-256)

SA life time: The Security Association lifetime in seconds

Force encapsulation: Choose the negotiation mode (main, aggressive). The aggressivemode has to be used when dealing with dynamic endpoint ad-dresses, but it is referred to be less secure compared to the mainmode as it reveals your identity to an eavesdropper.

Networks

When creating Security Associations, IPsec keeps track of routed networks within the tunnel. Packetsare only transmitted when a valid SA with the matching source and destination network is present.Therefore, you may need to specify the networks behind the endpoints by applying the following settings:

Local network address: The address of your Local Area Network (LAN)

Local network mask: The netmask of your LAN

Peer network address: The address of the remote network behind the peer

Peer network mask: The netmask of the remote network behind the peer

NAT address: Optionally, you can apply NAT (masquerading) for packets comingfrom a different local network. The NAT address must reside in thenetwork previously specified as the local network.

Note

Since the firmware 3.7.40.103, the maximum number of networks for individual IPsec tunnelshas increased from 4 to 10.

Note

See the IPsec configuration example in our Application notes (http://www.ra-com.eu/eng/products/m/midge/app/index.html), Chapter 2.2 IPsec2.

2 http://www.racom.eu/eng/products/m/midge/app/VPN_config.html#IPsec


Web Configuration

http://www.racom.eu/eng/products/m/midge/app/index.html

http://www.racom.eu/eng/products/m/midge/app/index.html

http://www.racom.eu/eng/products/m/midge/app/VPN_config.html#IPsec

7.5.3. PPTP

Point-to-Point Tunneling Protocol (PPTP) is a method for implementing virtual private networks betweentwo hosts. PPTP is easy to configure and widely deployed amongst Microsoft Dial-up networkingservers. However, it is nowadays considered insecure. When setting up a PPTP tunnel, you wouldneed to choose between server or client.

Listen address: Specifies on which IP address should be listened for incoming clientconnections

Server address: The server address within the tunnel

Client address range: Specifies a range of IP addresses assigned to each client

Username/password: The common username/password configuration

Once configured, individual clients can be configured with different credentials and IP addresses.


Web Configuration

A client tunnel requires the following parameters to be set:

Server address: The address of the remote server

Username: The username used for authentication

Password: The password used for authentication

7.5.4. GRE

The Generic Routing Encapsulation (GRE) is a tunneling protocol that can encapsulate a wide varietyof network layer protocols inside virtual point-to-point links over IP. GRE is defined in RFC 1701, 1702and 2784. It does not provide encryption nor authorization but can be used on an address-basis ontop of other VPN techniques (such as IPsec) for tunneling purposes.

The following parameters are required for setting up a tunnel:

Peer address The remote peer IP address


Web Configuration

Local tunnel address The local IP address of the tunnel

Local tunnel netmask The local subnet mask of the tunnel

Remote network The remote network address of the tunnel

Remote netmask The remote subnet mask of the tunnel

In general, the local tunnel address/netmask should not conflict with any other interface addresses.The remote network/netmask will result in an additional route entry in order to control which packetsshould be encapsulated and transferred over the tunnel.

7.5.5. Dial-in Server

On this page you can configure the Dial-in server in order to establish a data connection over GSMcalls. Thus, one would generally apply a required service type of 2G-only, so that the modem registersto GSM only. Naturally, a concurrent use of mobile Dial-Out and Dial-In connection is not possible.

Note

The Dial-in Server is not supported by the M!DGE/MG102i LTE hardware.

Administrative status Enabled/disabled - incoming call shall be /shall not be answered

Modem Specifies the modem on which calls can come in

Address range start: Start address of range of clients connecting to the dial-in server

Address range size: Number of client addresses connecting to the server

Dial-in operational status: Shows the current status of the connection

Besides the admin account you can configure further users in the user accounts section. which shallbe allowed to dial-in. Please note that Dial-In connections are generally discouraged. As they are im-plemented as GSM voice calls, they suffer from unreliability and poor bandwidth.


Web Configuration

7.6. SERVICES

7.6.1. SDK

RACOM routers are shipping with a Software Development Kit (SDK) which offers a simple and fastway to implement customer-specific functions and applications. It consists of:

1. An SDK host which defines the runtime environment (a so-called sandbox), that is, controllingaccess to system resources (such as memory, storage and CPU) and, by doing so, catering forthe right scalability.

2. An interpreter language called arena, a light-weight scripting language optimized for embeddedsystems, which uses a syntax similar to ANSI-C but adds support for exceptions, automatic memorymanagement and runtime polymorphism on top of that.

3. A RACOM-specific Application Programming Interface (API), which ships with a comprehensiveset of functions for accessing hardware interfaces (e.g. digital IO ports, GPS, external storagemedia, serial ports) but also for retrieving system status parameters, sending E-Mail or SMSmessages or simply just to configure the router.

Anyone, reasonably experienced in the C language, will find an environment that is easy to dig in.However, feel free to contact us via <[email protected]> and we will happily support you in findinga programming solution to your specific problem.

The Language

The arena scripting language offers a broad range of POSIX functions (like printf or open) and provides,together with tailor-made API functions, a simple platform for implementing any sort of applications tointerconnect your favourite device or service with the router.

Here comes a short example:

/* This script prints short status and if the SMS section is setted properly, the status will be send even to your mobile phone :-)*/

printf("------------------------------");printf("\n\n");printf(nb_status_summary(all));printf("\n\n");printf("------------------------------");

/* Please change the following number to your mobile phone number*/nb_sms_send("+420123456789", nb_status_summary(all));

A set of example scripts can be downloaded directly from the router, you can find a list of them in theappendix. The manual at menu SERVICES-Administration-Troubleshooting-SDK API gives a detailedintroduction of the language, including a description of all available functions.

SDK API Functions

The current range of API functions can be used to implement the following features:


Web Configuration

1. Send/Retrieve SMS2. Send E-mail3. Read/Write from/to serial device4. Control digital input/output ports5. Run TCP/UDP servers6. Run IP/TCP/UDP clients7. Access files of mounted media (e.g. an USB stick)8. Retrieve status information from the system9. Get or set configuration parameters10. Write to syslog11. Transfer files over HTTP/FTP12. Perform config/software updates13. Control the LEDs14. Get system events, restart services or reboot system15. Scan for networks in range16. Create your own web pages17. Voice control functions18. SNMP functions19. Various network-related functions20. Other system-related functions

The SDK API manual at menu SERVICES-Administration-Troubleshooting-SDK API provides anoverview but also explains all functions in detail.

Please note that some functions require the corresponding services (e.g. E-Mail, SMS) to be properlyconfigured prior to utilizing them in the SDK.

Let’s now pay some attention to the very powerful API function nb_status. It can be used to query therouter’s status values in the same manner as they can be shown with the CLI. It returns a structure ofvariables for a specific section (a list of available sections can be obtained by running cli status -h).

By using the dump function you can figure out the content of the returned structure:

/* Dump current WAN status */

dump ( nb_status ("wan") );

The script will then generate lines like maybe these:

struct(33): .WANLINK1_GATEWAY = string[15]: "192.168.131.253".WANLINK2_REGISTRATION_STATE = string[23]: "registeredInHomeNetwork".WANLINK1_STATE = string[2]: "up".WANLINK2_STATE_UP_SINCE = string[19]: "2015-06-10 14:41:59".WANLINK1_STATE_UP_SINCE = string[19]: "2015-06-10 14:41:43".WANLINK2_GATEWAY = string[11]: "10.64.64.64".WANLINK1_DIAL_ATTEMPTS = string[1]: "0".WANLINK2_SIGNAL_STRENGTH = string[3]: "-89".WANLINK2_DATA_DOWNLOADED = string[7]: "1705494".WANLINK2_DATA_UPLOADED = string[6]: "511619".WANLINK1_DATA_UPLOADED = string[8]: "51587351".WANLINK2_ADDRESS = string[11]: "10.203.3.28".WANLINK2_NETWORK = string[7]: "O2 - CZ"


Web Configuration

.WANLINK1_DIAL_SUCCESS = string[1]: "1"

.WANLINK1_ADDRESS = string[15]: "192.168.131.233"

.WANLINK1_DOWNLOAD_RATE = string[3]: "202"

.WANLINK2_SIM = string[4]: "SIM1"

.WANLINK2_DOWNLOAD_RATE = string[1]: "8"

.WANLINK1_UPLOAD_RATE = string[1]: "0"

.WANLINK2_UPLOAD_RATE = string[1]: "8"

.WANLINK2_DIAL_FAILURES = string[1]: "0"

.WANLINK1_TYPE = string[3]: "eth"

.WANLINK1_DIAL_FAILURES = string[1]: "0"

.WANLINK2_DIAL_ATTEMPTS = string[1]: "1"

.WANLINK2_MODEM = string[7]: "Mobile1"

.WANLINK1_INTERFACE = string[4]: "LAN2"

.WANLINK1_DATA_DOWNLOADED = string[8]: "95597767"

.WAN_HOTLINK = string[8]: "WANLINK1"

.WANLINK2_INTERFACE = string[5]: "WWAN1"

.WANLINK2_SERVICE_TYPE = string[4]: "HSPA"

.WANLINK2_DIAL_SUCCESS = string[1]: "1"

.WANLINK2_TYPE = string[4]: "wwan"

.WANLINK2_STATE = string[2]: "up"

In combination with the nb_config_set function, it is possible to start a re-configuration of any parts ofthe system upon status changes. You may find all possible parameters by reading the /etc/config/factory-config.cfg file accessible via CLI.

/etc/config $ cat factory-config.cfg | grep ntpnetwork.ntp.status =1network.ntp.server0 =0.pool.ntp.orgnetwork.ntp.server1 =1.pool.ntp.orgnetwork.ntp.ping =1network.ntp.interval =256network.ntp.gpstime =0network.ntp.access.0.address =192.168.1.0network.ntp.access.0.netmask =255.255.255.0network.ntp.access.1.address =network.ntp.access.1.netmask =network.ntp.access.2.address =network.ntp.access.2.netmask =

Here is an example how one might adopt those functions:

/* Check the current NTP server and set it to the IP address 192.168.0.2and enable the NTP synchronisation */

printf ("The NTP server was previously using IP address: ");printf (nb_config_get("network.ntp.server0"));printf("\n\n");

nb_config_set("network.ntp.server0=192.168.0.2");

if (nb_config_get ("network.ntp.status") == "0")


Web Configuration

printf ("and was not running.");printf("\n\n");nb_config_set ("network.ntp.status=1");

else printf ("and was running.");printf("\n\n");

printf ("The NTP server is now running with IP address: ");printf (nb_config_get("network.ntp.server0"));

Running SDK

In the SDK, we are speaking of scripts and triggers which form jobs. Any arena script can beuploaded to the router or imported by using dedicated user configuration packages. You may also editthe script directly at the Web Manager or select one of our examples. You also have a testing sectionon the router which can be used to check your syntax or doing test runs.

Once uploaded, you will have to specify a trigger, that is, telling the router when the script is to be ex-ecuted. This can be either time-based (e.g. each Monday) or triggered by one of the pre-defined systemevents (e.g. wan-up) as described in Section 7.6.7, “Events”. With both, a script and a trigger, you canfinally set up an SDK job now. The test event usually serves as a good facility to check whether yourjobis working as expected. The admin section also offers facilities to troubleshoot any issues and controlrunning jobs. The SDK host (sdkhost) corresponds to the daemon managing the scripts and their oper-ations and thus avoiding any harm to the system. In terms of resources, it will limit CPU and memoryfor running scripts and also provide a pre-defined portion of the available flash storage. You may,however, extend it by external USB storage or (depending on your model) SD cards.

Files written to/tmp will be hold in the memory and will be cleared upon a script restart.. As your scriptsoperate in the sandbox, you will have no access to the system tools (such as ifconfig).

Administration


Web Configuration

This page can be used to control the SDK host and apply the following settings:

Administrative status: Specifies whether SDK scripts should run or not

Scheduling priority: Specifies the process priority of the sdkhost, higher priorities will speedup scheduling your scripts, lower ones will have less impact to the hostsystem

Maximum flash usage: The maximum amount of Mbytes your scripts can write to the internalflash

Enable watchdog: This option enables watchdog supervision for each script. If the scriptdoes not respond or is stopped with an exit code not equal null, thesystem is rebooted.

The status page informs you about the current SDK status. It provides an overview about any finishedjobs, you can also stop a running job there and view the script output in the troubleshooting sectionwhere you will also find links for downloading the manuals and examples.

Job Management


Web Configuration

This page can be used to set up scripts, triggers and jobs.

It is usually a good idea to create a trigger first which is made up by the following parameters:

Name: A meaningful name to identify the trigger

Type: The type of the trigger, either time-based or event-based

Condition: Specifies the time condition for time-based triggers (e.g. hourly)

Timespec: The time specification which, together with the condition, specifies the time(s) whenthe trigger should be pulled

Event: The system event upon which the trigger should be pulled

You can now add your personal script to the system by applying the following parameters:

Name: A meaningful name to identify the script

Description: An optional script description

Arguments: An optional set of arguments passed to the script (supports quoting)


Web Configuration

Action: You may either edit a script, upload it to the system or select one of the examplescripts or an already uploaded script

You are ready to set up a job afterwards, it can be created by using the following parameters:

Name: A meaningful name to identify the job

Trigger: Specifies the trigger that should launch the job

Script: Specifies the script to be executed

Arguments: Defines arguments which can be passed to the script (supports quoting), they willprecede the arguments you formerly may have assigned to the script itself

Testing

/* Check the current NTP server and set it to the IP address 192.168.0.2and enable the NTP synchronisation */

printf ("The NTP server was previously using IP address: ");printf (nb_config_get("network.ntp.server0"));printf("\n\n");

nb_config_set("network.ntp.server0=192.168.0.2");

if (nb_config_get ("network.ntp.status") == "0")printf ("and was not running.");printf("\n\n");nb_config_set ("network.ntp.status=1");

else printf ("and was running.");printf("\n\n");

printf ("The NTP server is now running with IP address: ");printf (nb_config_get("network.ntp.server0"));

The testing page offers an editor and an input field for optional arguments which can be used to performtest runs of your script or test dedicated portions of it. Please note that you might need to quote argu-ments as they will otherwise be separated by white-spaces.


Web Configuration

/* arguments : schnick schnack "s c h n u c k" */

for (i = 0; i < argc ; i++) printf (" argv %d: %s\n", i, argv [i]);

/* generates:* argv 0: /scripts/testrun* argv 1: schnick* argv 2: schnack* argv 3: s c h n u c k*/

In case of syntax errors, arena will usually print error messages as follows (indicating the line and pos-ition where the parsing error occurred):

/scripts/testrun:2:10:FATAL: parse error, unexpected $, expecting ’;’

Note

It is now possible to upload SDK scripts into the Testing menu via browsing the requiredSDK script and clicking on the "Run" button.

SDK Sample Application

As an introduction, you can step through a sample application, namely the SMS control script, whichimplements remote control over short messages and can be used to send a system status back to thesender. The source code is listed in the appendix.

Once enabled, you can send a message to the phone number associated with a SIM / modem. Itgenerally requires a password to be given on the first line and a command on the second, such as:

admin01status

We strongly recommend to use authentication in order to avoid any unintended access, however youmay pass noauth as argument to disable it. You can then skip the first line containing the password.Having a closer look to the script, you will see that you will also be able to restrict the list of permittedsenders. Please inspect the system log for troubleshooting any issues.

The following commands are supported:

status An SMS with the following information will be returned

• Signal strength

• Mobile connection state (up/down)

• current IP address of the mobile interface

• current IP address of the VPN interface (if enabled)

connect This will initiate a Dial-out connection over GSM/UMTS and the VPN connection (ifenabled) and trigger sending an SMS with the following information:


Web Configuration

• current IP address of the PPP interface• current IP address of the VPN interface (if enabled)

disconnect terminates all WAN connections (including VPN)

reboot Initiates a system reboot

output 1 on Switch digital output 1 on

output 1 off Switch digital output 1 off

output 2 on Switch digital output 2 on

output 2 off Switch digital output 2 off

A response to the status command typically looks like:

System: MIDGE midge (0002A9FFC32E)WAN1: WWAN1 is up (10.204.8.3, Mobile1,HSPA, -65 dBm, LAI 23003)DIO: IN1=off, IN2=off, OUT1=off, OUT2=on

7.6.2. DHCP Server

This section can be used to individually configure a DHCP service for each LAN interface.

Operational mode: The DHCP operational mode can be disabled or set to the "server" or"relay" mode. As a server, the unit answers to DHCP requests fromhosts in the LAN directly. Aa a relay, the unit resends the requests tothe configured DHCP server which handles them.

First lease address: First address for DHCP clients


Web Configuration

Last lease address: Last address for DHCP clients

Lease duration: Number of seconds (30-86400) how long a given lease will be validuntil it has to be requested again

Persistent leases: By turning this option on, router will remember to give leases even aftera reboot. It can be used to ensure the same IP addresses are assignedto a particular host.

Ignore unknown hosts: By checking this option, only static hosts will obtain the IP leases

DHCP options: By default DHCP will hand out the interface address as the defaultgateway and DNS server address if not configured elsewhere. It ispossible to specify different addresses here.

Static Hosts: The option to add a static host configured with the IP address, MACaddress and/or hostname.

7.6.3. DNS Server

The DNS server can be used to proxy DNS requests towards servers on the net which have for instancebeen negotiated during WAN link negotiation. By pointing DNS requests to the router, one can reduceoutbound DNS traffic as it is caching already resolved names but it can be also used for serving fixedaddresses for particular host names.

Administrative status: Enabled or disabled

Default DNS server 1: The primary DNS server to be queried

Default DNS server 2: The secondary server which will be used in case the primary serveris not available.

You may further configure static hosts for serving fixed IP addresses for various hostnames. Pleaseremember to point local hosts to the router’s address for resolving them.


Web Configuration

7.6.4. NTP Server

This section can be used to individually configure the Network Time Protocol (NTP) server function.


Poll interval: Defines the polling interval (64-4096 seconds) for synchronizing thetime with the master clock servers

Allowed hosts: Defines the IP address range which is allowed to poll the NTP server

Note

See the description of how to set the correct router time in the section called “Time & Region”.

7.6.5. Dynamic DNS

Dynamic DNS client on this box is generally compatible with various DynDNS services on the Internetrunning by means of definitions by the DynDNS organization (see www.dyndns.com for server imple-mentations).



Web Configuration

Dynamic address: Specifies whether the address is derived from the hotlink, outgoing interfaceaddress or via an external service. Usually, the hotlink option is used.

Hostname: The host-name provided by your DynDNS service (e.g. mybox.dyndns.org)

Username: The user-name used for authenticating at the service

Password: The password used for authentication

Please note that your RACOM router can operate as DynDNS service as well, provided that you holda valid SERVER license and have your hosts pointed to the DNS service of the router.

7.6.6. E-mail client

The E-Mail client can be used to send notifications to a particular E-Mail address upon certain eventsor by SDK scripts.

Administrative status: E-mail client administrative status - enabled or disabled


Web Configuration

From address: Sender e-mail address

Server address: SMTP server address

Server port: SMTP server port (typically 25)

Authentication: Choose the required authentication method to authenticate againstthe SMTP server

Encryption: The optional encryption for the e-mail messaging (none or TLS)

Username: User name for authentication

Password: Password for authentication

After configuring E-mail successfully, you can also test e-mail messages.

7.6.7. Events

By using the event manager you can notify one or more recipients by SMS or E-Mail upon certainsystem events. These messages will contain a description provided by you and a short system info.

Additionally, you can choose the SNMP trap to be sent upon these events. Each event trap has its ownOID - .1.3.6.1.4.1.33555.1.100.0.X.0.X where X is trap related. See the descriptions of the events belowfor the specific OID numbers. Please contact our technical department for more details.

Note

Own traps can be configured via SDK. See SDK script examples.


Web Configuration

Events

The default texts for a specific Event are as follows:

DescriptionEvent (ID)CategoryA GSM call is coming incall-incoming (701)CALLOutgoing voice call is being establishedcall-outgoing (702)Dynamic DNS update failedddns-update-failed (802)DDNSDynamic DNS update succeededddns-update-succeeded (801)Dial-In connection went downdialin-down (409)DIALINDial-In connection came updialin-up (408)DIO IN1 turned offdio-in1-off (202)DIODIO IN1 turned ondio-in1-on (201)DIO IN2 turned offdio-in2-off (204)DIO IN2 turned ondio-in2-on (203)DIO OUT1 turned offdio-out1-off (206)DIO OUT1 turned ondio-out1-on (205)DIO OUT2 turned offdio-out2-off (208)DIO OUT2 turned ondio-out2-on (207)GPS signal is not availablegps-down (302)GPSGPS signal is availablegps-up (301)GRE connection went downgre-down (413)GREGRE connection came upgre-up (412)IPsec connection went downipsec-down (404)IPSECIPsec connection came upipsec-up (403)


Web Configuration

DescriptionEvent (ID)CategoryMobile IP connection went downmobileip-down (411)MOBILEIPMobile IP connection came upmobileip-up (410)OpenVPN connection went downopenvpn-down (402)OPENVPNOpenVPN connection came upopenvpn-up (401)PPTP connection went downpptp-down (407)PPTPPPTP connection came uppptp-up (406)SDK has been startedsdk-startup (507)SDKSMS has not been sentsms-notsent (602)SMSSMS has been receivedsms-received (603)SMS report has been receivedsms-report-received (604)SMS has been sentsms-sent (601)User login failedsystem-login-failed (501)SYSTEMUser login succeededsystem-login-succeeded (502)User logged outsystem-logout (503)System reboot has been triggeredsystem-rebooting (504)System has been startedsystem-startup (505)System time has been updatedsystem-time-updated (508)test eventtest (506)TESTUSB Ethernet device has been addedusb-eth-added (903)USBUSB Ethernet device has been removedusb-eth-removed (904)USB serial device has been addedusb-serial-added (905)USB serial device has been removedusb-serial-removed (906)USB storage device has been addedusb-storage-added (901)USB storage device has been removedusb-storage-removed (902)WAN link went downwan-down (101)WANWAN link came upwan-up (102)

7.6.8. SMS

This page lets you turn on the SMS event notification service and enable remote control via SMS.

Administration

On RACOM routers it is possible to receive or send short messages (SMS) over each mounted modem(depending on the assembly options). Messages are received by querying the SIM card over a modem,so prior to that, the required assignment of a SIM card to a modem needs to be specified on the SIMspage.

Please bear in mind, in case you are running multiple WWAN interfaces sharing the same SIM, thatthe system may switch SIMs during operation which will also result in different settings for SMS com-munication.


Web Configuration

Received messages are pulled from the SIMs and temporarily stored on the router but get cleared aftera system reboot. Please consider to consult an SDK script in case you want to process or copy them.

Sending messages heavily depends on the registration state of the modem and whether the providedSMS Center service works and may fail. You may use the sms-report-received event to figure outwhether a message has been successfully sent.

Please do not forget that modems might register roaming to foreign networks where other fees mayapply. You can manually assign a fixed network (by LAI) in the SIMs section.

The relevant page can be used to enable the SMS service and specify on which modem should operate.

Administrative status: Enable or disable SMS notifications and control

Request delivery report: Enable or disable receiving the confirmation whether SMS wassuccessfully received or not. This can be then read in the SMSStatus menu.

Routing & Filtering

By using SMS routing you can specify outbound rules which will be applied whenever messages aresent. You can forward them to an enabled modem. For a particular number, you can for instance enforcemessages be sent over a dedicated SIM.


Web Configuration

Phone numbers can also be specified by regular expressions, here are some examples:

+12345678 Specifies a fixed number+1* Specifies any numbers starting with +1+1*9 Specifies any numbers starting with +1 and ending with 9+[12]* Specifies any numbers starting with either +1 or 2

Please note that numbers have to be entered in international format including a valid prefix. On theother hand, you can also define rules to drop outgoing messages, for instance, when you want to avoidusing any expensive service or international numbers.

Both types of rules form a list will be processed in order, forwarding outgoing messages over the specifiedmodem or dropping them. Messages which are not matching any of the rules below will be dispatchedto the first available modem.

Filtering serves a concept of firewalling incoming messages, thus either dropping or allowing them ona per-modem basis. The created rules are processed in order and in case of matches will either dropor forward the incoming message before entering the system. All non-matching messages will be allowed.

Status

The status page can be used to the current modem status and get information about any sent or receivedmessages. There is a small SMS inbox reader which can be used to view or delete the messages.Please note that the inbox will be cleared each midnight in case it exceeds 512 kbytes of flash usage.

Testing

This page can be used to test whether SMS sending in general or filtering/routing rules works. Themaximum length per message part is limited to 160 characters, we also suggest to exclusively usecharacters which are supported by the GSM 7-bit alphabet.


Web Configuration

7.6.9. SSH/Telnet Server

Apart from the Web Manager, the SSH and Telnet services can be used to log into the system. Validusers include root and admin as well as additional users as they can be created in the User Accountssection. Please note, that a regular system shell will only be provided for the root user, the CLI will belaunched for any other user whereas normal users will only be able to view status values, the adminuser will obtain privileges to modify the system.

Please note that these services will be accessible from the WAN interface also. In doubt, please considerto disable or restrict access to them by applying applicable firewall rules.

The following parameters can be applied to the Telnet service:

Administrative status: Whether the Telnet service is enabled or disabled


Web Configuration

Server port: The TCP port of the service (usually 23)

The following parameters can be applied to the SSH service:

Administrative status: Whether the SSH service is enabled or disabled

Server port: The TCP port of the service (usually 22)

Disable admin login: If checked, access via SSH for admin and root users will be blocked.Other users may have access as usual, but with restricted privileges.

Disable password-based login: By turning on this option, all users will have to authenticate by SSHkeys which can be uploaded to the router.

7.6.10. SNMP Agent

M!DGE/MG102i is equipped with an SNMP daemon, supporting basic MIB tables (such as ifTable),plus additional enterprise MIBs to manage multiple systems. M!DGE/MG102i OID starts with1.3.6.1.4.1.33555.10 prefix. The corresponding VENDOR MIB can be downloaded from the router.

M!DGE/MG102i extensions contain support for:

• Rebooting the device• Updating to a new system software via FTP/TFTP/HTTP• Updating to a new system configuration via FTP/TFTP/HTTP• Getting WWAN/GNSS/WLAN/DIO information

Note

Attention must be paid to the fact that SNMP passwords have to be more than 8 characterslong. Shorter passwords will be doubled for SNMP, e.g. 'admin01' becomes 'admin01ad-min01'.

SNMP extensions can be read and triggered as follows:

• To get system software version:snmpget -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.1.0

• To get a kernel version:snmpget -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.2.0

• To get a serial number:snmpget -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.3.0

• To restart the device:snmpset -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.10.0 i 1

• To run a configuration update:snmpset -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.11.0 s "http://server/directory"


Web Configuration

http://server/directory

Note

config Update expects a zip-file named <serial-number>.zip in the specified directory whichcontains at least a "user-config.zip".Supported protocols are TFTP, HTTP(s) and FTP.Specifying a username/password or port is not yet supported.

• get configuration update status:snmpget -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.12.0The return value can be one of: (1) succeeded, (2) failed, (3) inprogress, (4) notstarted.

• run software update:snmpset -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.13.0 s "http://server/directory"

• get software update status:snmpget -v 3 -u admin -n "" -l authNoPriv -a MD5 -x DES -A admin01admin01 192.168.1.11.3.6.1.4.1.33555.10.40.14.0Return value can be either of: (1) succeeded, (2) failed, (3) inprogress, (4) notstarted.

SNMP Configuration

Administrative status: Enable or disable the SNMP agent

Operation mode: Specifies if agent should run in compatibilty mode or for SNMPv3 only

Contact: System maintainer or other contact information

Location: Device location

Listening port SNMP agent port

Once the SNMP agent is enabled, SNMP traps can be generated using SDK scripts or can be triggeredby various Events (see the SYSTEM → Events menu).


Web Configuration

SNMP Authentication

When running in SNMPv3, it is possible to configure the following authentication settings:

Authentication: Defines the authentication (MD5 or SHA)

Encryption: Defines the privacy protocols to use (DES or AES)

In general, the admin user can read and write any values. Read access willbe granted to any other system users.

There is no authentication/encryption in SNMPv1/v2c and should not be usedto set any values. However, it is possible to define its communities and author-itive host which will be granted administrative access.

Read community: Defines the community name for read access

Admin community: Defines the community name for admin access

Allowed host: Defines the host which is allowed for admin access

Note

The SNMP daemon is also listening on WAN interfaces and it is therefore suggested to re-strict the access via the firewall.

7.6.11. Web Server

This page can be used to configure different ports for accessing the Web Manager via HTTP/HTTPS.We strongly recommend to use HTTPS when accessing the web service via a WAN interface as thecommunication will be encrypted and thus avoids any misuse of the system.

In order to enable HTTPS you would need to generate or upload a server certificate in the sectionSYSTEM-Keys and Certificates.


Web Configuration

Administrative status: Enable or disable the Web server

HTTP port: Web server port for HTTP connections

HTTPS port: Web server port for HTTPS connections

HTTPS certificate: Either information that the certificate is 'installed' or a link to createsuch certificate.

Enable CLI-PHP: Enable CLI-PHP service (see Section 8.16, “CLI–PHP”)

7.6.12. Redundancy

This section can be used to set up a redundant pair of M!DGE/MG102is (or other systems) by runningthe Virtual Router Redundancy Protocol (VRRP) among them. A typical VRRP scenario defines thefirst host playing the master and another the backup device, they both define a virtual gateway IP addresswhich will be distributed by gratuitous ARP messages for updating the ARP cache of all LAN hosts andthus redirecting the packets accordingly.

A takeover will happen within approximately 3 seconds as soon as the partner is no longer reachable(checked via multicast packets). This may happen when one device is rebooting or the Ethernet linkwent down. Same applies when the WAN link goes down.

In case DHCP has been activated, please keep in mind that you will need to reconfigure the DHCPgateway address offered by the server and let them point to the virtual gateway address. In order toavoid conflicts you may turn off DHCP on the backup device or even better, split the DHCP lease rangein order to prevent any lease duplication.

Note

M!DGE/MG102i assigns a priority of 100 to the master and 1 to the backup router. Pleaseadapt the priority of your third-party device appropriately.


Web Configuration

Administrative status: Enable or disable Redundancy

Role: Role of this system (either master or backup)

VID: The Virtual Router ID (you can theoretically run multiple instances)

Interface: Interface on which VRRP should be performed

Virtual gateway address: Virtual gateway address formed by the participating hosts


Web Configuration

7.7. SYSTEM

7.7.1. System

Settings

Local host name: The local system hostname

Application area: The desired application area which influences the system behavioursuch as registration timeouts when operating in the mobile environ-ment.

Syslog redirect address: The host where system log messages should be forwarded to. Youcan use for example a tiny system log server for Windows includedin TFTP32.

Syslog max. file size: The maximum log file size in kilobytes until it's rotated

Reboot delay: The number of seconds to wait before the reboot is initiated (mightbe needed for some system-rebooting events)

Enable multicast Activates an IGMP proxy and enables multicast routing for the cur-rent hotlink interface towards LAN interfaces.

Enable discovery Enables host discovery over LLDP (Link Layer Discovery Protocol),CDP (Cisco Discovery Protocol), FDP (Foundry Discovery Protocol),SONMP (Nortel Discovery Protocol) and EDP (Extreme DiscoveryProtocol). IRDP implements RFC1256 and can also inform locallyconnected hosts about the nexthop gateway. Any discovered hostswill be exposed to the LLDP-MIB and can be queried over SNMPor CLI/GUI.


Web Configuration

LED Settings: You can configure the behaviour of the status LEDs on the frontpanel of your device. They are usually divided into two banks - left(M!DGE) or upper (MG102i) for the digital IO port status or right(M!DGE) or lower (MG102i) for the connection status indication.You may configure toggle mode, so that the LEDs periodically showboth bank states. See the LEDs description in Section 4.3, “Indica-tion LEDs”.

Time & Region

Network Time Protocol (NTP) is a protocol for synchronizing the clocks of computer systems overpacket-switched, variable-latency data networks. M!DGE/MG102i can synchronize its system time withan NTP server. If enabled, time synchronisation is usually triggered after a WAN link has come up butbefore starting any VPN connections. Further time synchronisations are scheduled in the backgroundevery 60 minutes.

Current system time: The current system time which can be synchronized agains a validNTP server or set manually. If manually set, the time is lost afterthe reboot.

NTP server 1: The primary NTP server IP address or hostname

NTP server 2 (optional): The optional secondary NTP server IP address or hostname

Time zone: Time zone based on your geographical location

Daylight saving changes: This option can be used to reflect daylight saving changes (e.g.switching from summer to standard time) depending on the selectedtime zone.

Sync will perform the time synchronisation immediatelly.

Note

The System information menu has been moved into the HOME menu (since firmware 3.7.x).


Web Configuration

Reboot

This menu can be used to reboot the system. All WAN links will be interrupted.

7.7.2. Authentication

Authentication

This page offers a simple shortcut to allow only secure connections (SSH, HTTPS) for managing therouter. If the option "Secure authentication preferred" is set, users will be redirected to HTTPS but canstill login via HTTP/telnet.

User Accounts

This page lets you manage the user accounts on the device.

The standard admin user is a built-in power user that has permission to access the Web Manager andother administrative services and is used by several services as the default user. Keep in mind thatthe admin password will be also applied to the root user which is able to enter a system shell. Anyother user represents a user with lower privileges, for instance it has only permission to view the statuspage or retrieve status values when using the CLI.

Username: Define a user name


Web Configuration

Description: The user description

Shell Choose whether the CLI or shell command prompt shall be startedafter the user is logged in via SSH/Telnet. This is currently applicableonly for the admin user.

Password: Define a password

Password confirmation: Confirm the password

Remote Authentication

A remote RADIUS server can be used to authenticate users. This applies for the Web Manager andother services supporting and incorporating remote authentication.

Administrative status: Enable or disable remote authentication

Server address: RADIUS server address

Secret: Secret used to authenticate against the RADIUS server

Authentication port: Port used for authentication

Accounting port: Port used for accounting messages

Use for login: This option enables remotely-defined users to access the Web Manager

7.7.3. Software Update

Manual Software Update

This menu can be used to run a manual software update.


Web Configuration

Update operation: The update operation method being used. You can upload the image ordownload it from the given URL

URL: You can upload the image or download it from the given URL.

When issuing a software update, the current configuration (including files like keys/certificates) will bebackuped. Any other modifications to the filesystem will be erased. The configuration is generallybackward-compatible. We also apply forward compatibility when downgrading to a previous softwarewithin the same release line (e.g. 3.6.40.X), which is accomplished by sorting out unknown configurationdirectives which actually may lead to loss of settings and features. Therefore, it’s always a good ideato keep a copy of the working configuration. Generally, we do not recommend downgrading the software.

Important

In case you perform a major downgrade to a previous release line (e.g. 3.6.40.X to 3.5.40.X),the configuration will be set to factory defaults. Also keep in mind, that some hardwarefeatures may not work (e.g. if not implemented in that version). In doubt, please consult oursupport team.

A software image can be either uploaded via the Web Manager or retrieved from a specific URL. It willbe unpacked and deployed to a spare partition which gets activated if the update completed successfully.The whole procedure is accompanied by all green LEDs flashing up, the subsequent system rebootgets denoted by a slowly blinking Status LED. The backuped configuration will be applied at bootupand the Status LED will blink faster during this operation. Depending on your configuration, this maytake a while.

Important

The upgrade from 3.6.41.x and newer firmwares is fully compatible. If you upgrade fromolder releases, you have to reset the unit into the factory settings (only if you need to usethe serial interface Protocol server functionality). The previously saved configuration canbe uploaded to the station manually afterwards.


Web Configuration

Automatic Software Update

Status: Enable/disable automatic software update

Time of day: Every day at this time M!DGE/MG102i will do a check for updates

URL: The server URL where the software update package should be downloaded from.Supported protocols are TFTP, HTTP(s), and FTP

Firmware Update

This menu can be used to perform a firmware update of a specific module.

Update operation: The update operation method being used. You can upload a firmware packageor download the files from a specifc URL.

URL: The server URL where the firmware files should be downloaded from. Sup-ported protocols are TFTP, HTTP, HTTPS, and FTP (protocol://serv-er/path/file).

Software Profiles

In every router you have two software profiles. One is active (currently used) and one is inactive. Youcan easily switch between these profiles any time.

It can be for example useful when there is some issue with the newest firmware and you need to restorethe previous firmware version easily. Or you can just test some new features in the newest firmwareand then get back to the previous one.


Web Configuration

7.7.4. Configuration

Configuration via the Web Manager becomes tedious for large volumes of devices. M!DGE/MG102itherefore offers automatic and manual file-based configuration to automate things. Once you havesuccessfully set up the system you can back up the configuration and restore the system with it after-wards. You can either upload a single configuration file (.cfg) or a complete package (.zip) containingthe configuration file and a packed version of other essential files (such as certificates).

File Configuration

This section can be used to download the currently running system configuration (including essentialfiles such as certificates).

The current configuration file is updated after every change and the time of this update is displayedalong with a configuration version and a security hash. The current configuration can be updatedmanually by pressing the Apply button.


Web Configuration

In order to restore a particular configuration you can upload a configuration previously downloaded orupdate configuration from the provided URL link.

You can choose between missing configuration directives stay the same as in the currently runningconfiguration.

Automatic Updates

Status: Enable/disable automatic configuration update

Time of day: Time of day when the system will check for updates

URL: The server URL where the configuration file should be retrieved from (supportedprotocols are HTTP(s), TFTP, FTP)


Web Configuration

Factory Configuration

This menu can be used to reset the device to factory defaults. Your current configuration will be lost.

This procedure can also be initiated by pressing and holding the Reset button for at least 10 seconds.A successfully initiated factory reset can be noticed by all LEDs being turned on.

Factory reset will set the IP address of the first Ethernet interface back to 192.168.1.1. You will be ableto communicate again with the device using the default network parameters.

You may store the currently running configuration as factory defaults which will reside active even whena factory reset has been initiated (e.g. by your service staff). Please ensure that this corresponds to aworking configuration. A real factory reset to the default settings can be achieved by restoring the ori-ginal factory configuration and initiating the factory reset again.

Important

If you store the currently running configuration as the factory defaults, have in mind that thepassword is also stored within this configuration.

7.7.5. Troubleshooting

Network Debugging

Various tools reside on this page for further analysis of potential configuration issues. The ping utilitycan be used to verify the remote host reachability.


Web Configuration

Define the remote host (IP address or hostname), number of packets and the packet size.

The traceroute utility can be used to print the route to a remote host.

Define the target host (IP or hostname), Time-To-Live (TTL - number of hops on the resulting route)and the timeout in seconds (max. time to wait for the final respond).

The tcpdump utility generates a network capture (PCAP) of an interface which can be later analyzedwith Wireshark.


Web Configuration

Several basic protocols can be excluded from the resulting PCAP file (HTTP, HTTPS, Telnet and SSH).

Note

The default number of received packets is set to 1000. For downloading the file, just clickon the Download button. The captured file can be also downloaded from the /tmp/ directoryvia the appropriate file manager.

The darkstat utility can be used to visualize your current network connections and traffic on a particularinterface.


Web Configuration

After the utility initialization, it can be viewed in a separate window. Displaying graphs and individualhost statistics are supported.

System Debugging

Log files can be viewed, downloaded and reset here. Please study them carefully in case of any issues.


Web Configuration

Default debugging levels for individual daemons are as follows:

• configd – 4

• watchdog – 4

• swupdate – 5

• wwan-managerc – 5

• led-manager – 5


Web Configuration

• event-manager – 5

• link-manager – 5

• wwanmd – 5

• surveyor – 5

• mobile-node – 4

• home-agent – 4

• voiced – 4

• smsd – 5

• sdkhost – 6

• qmid – 4

• ser2net – 4

• rrsp2 – 1

• qosd – 0

You can change the values to suit your needs and you can reset the values into their defaults bypressing the "Reset" button afterwards.

Tech Support

You can generate and download a tech support file here.

We strongly recommend providing this file when getting in touch with our support team, either by e-mail or via our online support form, as it would significantly speed up the process of analyzing andresolving your problem.

Note

For both direct E-mail and Online support form a connection to the Internet has to be avail-able.


Web Configuration

You can encrypt the Techsupport file in order to secure the file against reading it without knowing thesecurity key for decrypting the file. It is more secure way to send the techsupport file via nonsecure e-mail. The decrypting key is known by our support team only and cannot be provided to anybody.

7.7.6. Keys & Certificates

The key and certificate page lets you generate required files for securing your services (such as theHTTPS/WebServer and SSH server). Keep in mind that you will need to create keys and certificatesfor VPN or WLAN in case of certificate based authentication. You can also revoke and invalidate certi-ficates again (for instance if they have been compromised or lost).

The entry pages shows an overview about installed keys and certificates. The following sections mayappear:

Root CA: The root Certificate Authority (CA) which issues certificates, its key can be used tocertify it at trusted third party on other systems.


Web Configuration

Web Server: The certificates for the Web server required for running HTTP over SSL (HTTPS).

SSH Server: The DSS/DSA keys for the SSH server.

OpenVPN: Server or client keys and certificates for running OpenVPN tunnels.

IPsec: Server or client keys and certificates for running IPsec tunnels.

WLAN: Keys and certificates for implementing certificate-based WLAN authentication (e.g.WPA-EAP-TLS).

Authorities: Other certificate authorities which we trust when establishing SSL client connections.

For each certificate section it is possible to perform the following operations:

generate locally: Generate key and certificate locally on M!DGE/MG102i

upload files: Key and certificate will be uploaded. We support files in PKCS12,PKCS7, PEM/DER format as well as RSA/DSS keys in OpenSSH orDropbear format.

enroll via SCEP: Enroll key and certificate via SCEP

download certificate: Download key and certificate in ZIP format (files will be encoded inPEM format)

create signing request: Generate key locally and create a signing request to retrieve a certi-ficate signed by another authority

erase certificate: Erase all keys and certificates associated with this section


Web Configuration

Configuration

This page provides some general configuration options which will be applied when operating with keysand certificates. If keys, certificates and signing requests are generated locally, the following settingswill be taken into account:

Organization (O): The certificate owner’s organization

Department (OU): The name of the organizational unit to which the certificate issuer belongs

Location (L): The certificate owner’s location

State (ST): The certificate owner’s state

Country (C): The certificate owner’s country (usually a TLD abbreviation)

Please be aware of the fact, that the local random number generator (RNG) provides pretty good ran-domness for most applications. If stronger cryptography is mandatory, we suggest to create the keysat an external RNG device or manage all certificates completely on a remote certification server. Nev-ertheless, using a local certificate authority can issue and manage all required certificates and also runa certificate revokation list (CRL).

When importing keys, the certificate and key file can be uploaded individually encoded in PEM/DERor PKCS7 format. All files (CA certificate, certificate and private key) can also be uploaded in one strokeby using the container format PKCS12. RSA/DSS keys can be converted from OpenSSH or Dropbearformats. It is possible to specify the passphrase for opening the private key. Please note that the systemwill generally apply the system-wide certificate passphrase on a key when installing the certificate.Thus, changing the general passphrase will result in all local keys getting equipped with the new one.


Web Configuration

SCEP Configuration

If certificates are getting enrolled by using the Simple Certificate Enrollment Protocol (SCEP) the fol-lowing settings can be configured:

SCEP status: Specifies whether SCEP is enabled or not.

URL: The SCEP URL, usually in the form http://<host>/<path>/pkiclient.exe.

CA fingerprint: The fingerprint of the certificate used to identify the remote authority.If left empty, any CA will be trusted.

Fingerprint algorithm: The fingerprint algorithm for identifying the CA (MD5 or SHA1).

Poll interval: The polling interval in seconds for a certificate request.

Request timeout: The max. polling time in seconds for a certificate request.

When enrolling certificates, the CA certificate will be initially fetched from the specified SCEP URL usingthe getca operation. It will be shown on the configuration page and it has to be verified that it belongsto the correct authority. Otherwise, the CA must be rejected. This part is essential when using SCEPas it builds up the chain of trust. If a certificate enrollment request times out, it is possible to re-triggerthe interrupted enrollment request and it will be resumed using the previously generated key. In casea request has been rejected, you are required to erase the certificate first and then start the enrollmentprocess all over again.

Authorities

For SSL client connections (as used by SDK functions or when downloading configuration/softwareimages) you might upload a list of CA certificates which are considered trusted. To obtain the CA cer-tificate from a particular site with Mozilla Firefox, the following steps will be required:

• Point the browser to the relevant HTTPS website• Click the padlock in the address bar• Click the More Information and the View Certificate button• Select the Details tab and press the Export button• Choose a path for the file (e.g. website.pem)


Web Configuration

7.7.7. Licensing

This menu allows you to view and update the license status of your system. Note that some featuresare disabled if no valid license is provided.

Availability means that the licence can be applied to the current hardware. The valid license is activeif the status "licensed" is displayed in the respective line.

7.7.8. Legal Notice

A dedicated GUI page under SYSTEM is pointing out that M!DGE/MG102i contains in part open sourcesoftware that may be licensed under GPL, LGPL or other open source licenses. It further provides de-tailed information for each package, including the relevant license text and the corresponding sourceURL. The user is now obliged to accept our end user license agreement during the initial setup of therouter. We remind you that the source code of any package can be obtained by contacting our technicalsupport at [email protected].


Web Configuration


Web Configuration

7.8. LOGOUT

Log out from Web Manager.


Web Configuration

8. Command Line InterfaceThe Command Line Interface (CLI) offers a unified control interface to the router and can be used toget/set configuration parameters, apply updates, restart services or perform other system tasks.

The CLI should be started using cli -i command from system shell or when logging as root user. A listof available commands can be displayed by running cli -l. It will be started automatically in interactivemode when logging in as admin user.

$ cliName:

cli (Command Line Utility)

Usage:[-ilvh] <command>

~ $ cli -iMIDGE Command Line Interface (version 0.2)(C) Copyright RACOM s.r.o, Czech Republic

Enter 'help' for a list of available commandsor hit the TAB key for auto-completion.

Ready to serve.

>

The CLI supports the TAB completion, that is expanding entered words or fragments by hitting the TABkey at any time. This applies to commands but also to arguments and generally offers a convenientway for working on the shell.

Please note that each CLI session will perform an automatic logout as soon as a certain time of inactivity(10 minutes by default) have been reached. It can be turned off by the command no-autologout.

The CLI can be exited by running exit.

8.1. General usage

When operating the CLI in interactive mode, each entered command will be executed by the RETURNkey. You can use the Left and Right keys to move the current point between entered characters oruse the Up and Down keys to search the history of entered commands. Pressing CTRL-c twice orCTRL-d on an empty command line will exit the CLI.

List of supported key sequences:

ActionKey SequenceMove to the start of the current line.CTRL-aMove to the end of the line.CTRL-eMove forward a character.CTRL-f


Command Line Interface

ActionKey SequenceMove back a character.CTRL-bMove forward to the end of the next word.ALT-fMove back to the start of the current or previous word.ALT-bClear the screen leaving the current line at the top of the screen, with an argumentgiven refresh the current line without clearing the screen.CTRL-l

Fetch the previous command from the history list, moving back in the list.CTRL-pFetch the next command from the history list, moving forward in the list.CTRL-nMove to the first line in the history.ALT-<Move to the end of the input history.ALT->Search backward starting at the current line and moving up through the history.CTRL-rSession will be frozen.CTRL-sReactivate frozen session.CTRL-qDelete character at point or exit CLI if at the beginning of the line.CTRL-dDrag the character before point forward moving point forward as well. If point is atthe end of the line, then this transposes the two characters before point.CTRL-t

Drag the word before point past the word after point, moving point over that wordas well. If point is at the end of the line, this transposes the last two words on theline.

ALT-t

Delete the text from point to the end of the line.CTRL-kYank the top of the deleted text into the buffer at point.CTRL-y

Please note, that it can be required to apply quotes (") when entering commands with arguments con-taining whitespaces.

The following sections are trying to explain the available commands.

8.2. Print help

The help command can be used to get the list of available commands when called without arguments,otherwise it will print the usage of the specified command.



> helpUsage:

help [<command>]

Available commands:

get Get config parametersset Set config parametersupdate Update system facilitiescert Manage keys and certificatesstatus Get status informationscan Scan networkssend Send message, mail, techsupport or ussdrestart Restart servicedebug Debug systemreset Reset system facilitiesreboot Reboot systemshell Run shell commandhelp Print help for commandno-autologout Turn off auto-logouthistory Show command historyexit Exit

8.3. Getting config parameters

The get command can be used to get configuration values (not the current values).

get -hUsage:

get [-hsvfc] <parameter> [<parameter>..]

Options:-s generate sourceable output-v validate config parameter-f get factory default rather than current value-c show configuration sections

See the following example for reading configuration DIO values:

> get dio.out1dio.out1=on> get dio.out2dio.out2=on

8.4. Setting config parameters

The set command can be used to set configuration values.

> set -hUsage:



set [-hv] <parameter>=<value> [<parameter>=<value>..]

Options:-v validate config parameter

See the following example for setting configuration digital output values. Both values will be "off" andboth values will be also "off" after the next start-up procedure.

> set dio.out1=off> set dio.out2=off

8.5. Updating system facilities

The update command can be used to perform various system updates.

> update -hUsage:

update [-hfrsn] <software|config|license|sshkeys> <URL>

Options:-r reboot after update-f force update-n don't reset missing config values with factory defaults-s show update status

Available update targets:

software Perform software updatefirmware Perform module firmware updateconfig Update configurationlicense Update licensessshkeys Install SSH authorized keys

8.6. Manage keys and certificates

The update command can be used to manage keys and certificates.

> cert -hUsage:

cert [-h] [-p phrase] <operation> <cert> [<url>]

Possible operations:

install install a certificate from specified URLcreate create a certificate locallyenroll enroll a certificate via SCEPerase erase an installed certificateview view an installed certificate



8.7. Getting status information

The status command can be used to get various status information of the system.

> status -hUsage:

status [-hs] <section>

Options:-s generate sourceable output

Available sections:

summary Short status summaryinfo System and config informationconfig Current configurationsystem System informationconfiguration Configuration informationlicense License informationwwan WWAN module statuswlan WLAN module statusgnss GNSS (GPS) module statuseth Ethernet interface statuslan LAN interface statuswan WAN interface statusopenvpn OpenVPN connection statusipsec IPsec connection statuspptp PPTP connection statusgre GRE connection statusdialin Dial-In connection statusmobileip MobileIP statusdio Digital IO statusaudio Audio module statuscan CAN module statusuart UART module statusredundancy Redundancy statussms SMS statusfirewall Firewall statusqos QoS statusneigh Neighborhood statuslocation Current Location

In the following example, we read the current DIO values. Remember that the current states do notcorrespond to the configuration values set with "set dio.out" commands.

> status dio=== DIGITAL IO INFORMATION ===IN1: offIN2: onOUT1: onOUT2: off



8.8. Scan

The scan command can be used to scan the mobile network for the possible networks. Note that theactive mobile connection will be deactivated during the scan procedure.

> scan -hUsage:

scan [-hs] <interface>

Options:-s generate sourceable output

Available interfaces:

Mobile1 (wwan0)

See the example below:

> scan -s Mobile1

NETWORK1_NAME="O2 - CZ"NETWORK1_TECH="3G"NETWORK1_LAI="23002"NETWORK1_RAT="UTRAN"NETWORK1_STATUS="Current"

NETWORK_COUNT="1"

8.9. Sending e-mail or SMS

The send command can be used to send a message via E-Mail/SMS to the specified address or phonenumber.

> send -hUsage:

send [-h] <type> <dest> <msg>

Options:<type> type of message to be sent (mail, sms, techsupport, ussd)<dest> destination of message (mail-address, phone-number or argument)<msg> message to be sent

8.10. Restarting services

The restart command can be used to restart system services.

> restart -hUsage:

restart [-h] <service>



Available services:

configd Configuration daemondnsmasq DNS/DHCP serverdropbear SSH serverfirewall Firewall and NAPTgpsd GPS daemongre GRE connectionsipsec IPsec connectionslighttpd HTTP serverlink-manager WAN linksnetwork Networkingopenvpn OpenVPN connectionspptp PPTP connectionsqos QoS daemonsmsd SMS daemonsnmpd SNMP daemonsurveyor Supervision daemonsyslog Syslog daemontelnet Telnet serverusbipd USB/IP daemonvoiced Voice daemonvrrpd VRRP daemonwlan WLAN interfaceswwan-manager WWAN manager

8.11. Debug

The debug command can be used to display individual daemons debugging output.

> debug -hUsage:

debug [-hr] [-l <level>] <target>

Options:-l <level> set debug level-r reset debug level

Available debug targets:

systemscriptsconfigdwatchdogswupdatewwan-managerled-managerevent-managerlink-managerwwanmdsurveyor



mobile-nodehome-agentvoicedsmsdsdkhostqmidser2netqosdrrsp2

8.12. Resetting system

The reset command can be used to reset the router back to factory defaults.

> reset -hUsage:

reset [-h] [facility]

Available reset facilities:

factory Reset system to factory defaultsstatistics Reset link statistics

8.13. Rebooting system

The reboot command can be used to reboot the router.

> reboot -hUsage:

reboot [-h]

8.14. Running shell commands

The shell command can be used to execute a system shell and run any arbitrary application.

> shell -hUsage:

shell [-h] [<cmd>]

8.15. CLI commands history

The history command displays the history of CLI commands entered on the unit.

> history1 help2 get -h3 get dio.out14 set dio.out1=off



5 set dio.out2=off6 set dio.out1=on7 get dio.out18 get dio.out29 set -h

8.16. CLI–PHP

CLI-PHP, an HTTP front-end to the CLI application, can be used to configure and control the routerremotely. It is enabled in factory configuration, thus can be used for deployment purposes, but disabledas soon as the admin account has been set up. The service can later be turned on/off by setting thecliphp.status configuration parameter:

> get cliphp.statuscliphp.status=0

> set cliphp.status=1> get cliphp.statuscliphp.status=1

cliphp.status=0 Service is disabledcliphp.status=1 Service is enabled

This section describes the CLI-PHP interface for Version 2, the general usage (GET requests) is definedas follows:

Usage:http (s)://cli.php?<key1>=<value1>&<key2>=<value2>..<keyN>=<valueN>

Available keys:output Output format ( html, plain )usr Username to be used for authenticationpwd Password to be used for authenticationcommandV Command to be executedarg0..arg31 Arguments passed to commandsNotes:

The commands correspond to CLI commands as seen by 'cli −l', the arguments(arg0..arg31) will be directly passed to the cli application

Thus, an URL containing the following sequence:

command=get&arg0=admin.password&arg1=admin.debug&arg2=admin.access

will lead to cli being called as:

$ cli get "admin.password" "admin.debug" "admin.access"

It supports whitespaces but please be aware that any special characters in the URLmust be specified according to RFC1738 (which usually done by common clients suchas wget, lynx, curl).



Response:The returned response will always contain a status line in the format:

<return>: <msg>

with return values of OK if succeeded and ERROR if failed. Any output from thecommands will be appended

Examples:

OK: status command successfulERROR: authentication failed

status – Display status information

Key usage:command=status[&arg0=<section>]

Notes:Available sections can be retrieved by running command=status&arg0=−h.System status can be displayed without authentication.

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=status&arg0=−hhttp://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=status&arg0=summaryhttp://192.168.1.1/cli.php?version=2&output=html&command=status

get – Get configuration parameter

Key usage:

command=get&arg0=<config−key>[&arg1=<config−key>..]

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=get&arg0=config.version

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=get&arg0=openvpn.status&arg1=snmp.status&arg2=ipsec.status

set – Set configuration parameter

Key usage:command=set&arg0=<config−key>&arg1=<config−value>[&arg2=<config−key>&arg3=<config−value>..]

Notes:In contrast to the other commands, this command requires a set



of tuples because of the reserved '=' char, i.e.[arg0=key0, arg1=val0], [arg2=key1, arg3=val1], [arg4=key2, arg5=val2], etc

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=set&arg0=snmp.status&arg1=1

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=set&arg0=snmp.status&arg1=0&arg2=openvpn.status&arg3=1

restart – Restart a system service

Key usage:command=restart&arg0=<service>

Notes:Available services can be retrieved by running 'command=restart&arg0=−h'

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=restart&arg0=−h

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=restart&arg0=link−manager

reboot - Trigger system reboot

Key usage:command=reboot

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=reboot

reset - Run factory reset

Key usage:command=reset

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=reset



update - Update system facilities

Key usage:command=update&arg0=<facility>&arg1=<URL>

Notes:Available facilities can be retrieved by running 'command=update

&arg0=−h'

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=127admin01&command=update&arg0=software&arg1=tftp://192.168.1.254/latest

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=update&arg0=config&arg1=tftp://192.168.1.254/user−config.zip

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=update&arg0=license&arg1=http://192.168.1.254/xxx.lic

send - Send SMS

Key usage:command=send&arg0=sms&arg1=<number>&arg2=<text>

Notes:The phone number has to be specified in international format such

as +123456789 including a leading plus sign (which can be encoded with \%2B).The SMS daemon must be properly configured prior to using that function.

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=send&arg0=sms&arg1=\%2B123456789&arg2=test

send - Send E-Mail

Key usage:command=send&arg0=mail&arg1=<address>&arg2=<text>

Notes:The address has to be a valid E−Mail address such as [email protected]

(the at−sign can be encoded with \%40). The E−Mail client must be properlyconfigured prior to using that function.

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=send&arg0=mail&arg1=abc\%40abc . com&arg2=test



send - Send TechSupport

Key usage:command=send&arg0=techsupport&arg1=stdout

command=send&arg0=techsupport&arg1=<address>&arg2=<subject>Notes:

The address has to be a valid E−Mail address such as [email protected](the at−sign can be encoded with \%40) . The E−Mail client must be properlyconfigured prior to using that function. In case of stdout , the downloadedtechsupport file will be called 'download'.

Examples:

http://192.168.1.1/cli.php?version=2&output=mime&usr=admin&pwd=admin01&command=send&arg0=techsupport&arg1=stdout

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=send&arg0=techsupport&arg1=abc\%40abc.com&arg2=subject

send - Send USSD code

Key usage:command=send&arg0=ussd&arg1=<card>&arg2=<code>

Notes:The argument card specifies the card module index (e.g. 0 for wwan0 ).

The USSD code can consist of digits , plus signs , asterisks(can be encoded with \%2A) and dashes (can be encoded with \%23) .

Examples:

http://192.168.1.1/cli.php?version=2&output=html&usr=admin&pwd=admin01&command=send&arg0=ussd&arg1=0&arg2=\%2A100\%23



9. Troubleshooting

9.1. Common errors

With GPRS/UMTS connection (even if GSM signal is good enough) following Errors are common:

SIM missing Check the SIM card status in the INTERFACES → SIMs menu, turnoff the unit, insert/re-insert the SIM card and power up the unit again

PIN code required Insert the correct PIN code in the INTERFACES → SIMs → Config-uration menu

Connection not established orfailed

See the SYSTEM → Troubleshooting → System Debugging outputfor any errors/warnings

9.2. Messages

The Web Manager displays messages in the status bar in the footer of a web page.

There are three levels:

Green The action was performed successfully.

Yellow Warning – please consider the information.

Red Error – command was not performed, typically with recommended action which is requiredbefore the possible successful action.

9.3. Troubleshooting tools

9.3.1. Pinger

Connection from the M!DGE/MG102i router can be checked using the built-in pinger available in theSYSTEM → Troubleshooting → Network Debugging menu.

The traceroute command is available in the same menu for tracing the packets from the M!DGE/MG102irouter to the Host.


Troubleshooting

9.3.2. Log Files

Information about boot-up process and about running processes can be found in the Linux-like Logfiles, see the SYSTEM→ Troubleshooting → System Debugging menu.


Troubleshooting

10. Safety, environment, licensing

10.1. Safety instructions

The M!DGE/MG102i Wireless Router must be used in compliance with any and all applicable interna-tional and national laws and in compliance with any special restrictions regulating the utilization of thecommunication module in prescribed applications and environments.

To prevent possible injury to health and damage to appliances and to ensure that all the relevant pro-visions have been complied with, use only the original accessories. Unauthorized modifications orutilization of accessories that have not been approved may result in the termination of the validity ofthe guarantee.

The M!DGE/MG102i Wireless Routers must not be opened. Only the replacement of the SIM card ispermitted.

Voltage at all connectors of the communication module is limited to SELV (Safety Extra Low Voltage)and must not be exceeded.

For use with certified (CSA or equivalent) power supply, which must have a limited and SELV circuitoutput. The M!DGE/MG102i is designed for indoor use only. Do not expose the communication moduleto extreme ambient conditions. Protect the communication module against dust, moisture and hightemperature.

We remind the users of the duty to observe the restrictions concerning the utilization of radio devicesat petrol stations, in chemical plants or in the course of blasting works in which explosives are used.Switch off the communication module when traveling by plane.

When using the communication module in close proximity of personal medical devices, such as cardiacpacemakers or hearing aids, you must proceed with heightened caution.

If it is in the proximity of TV sets, radio receivers and personal computers, M!DGE/MG102i WirelessRouter may cause interference.

It is recommended that you should create an approximate copy or backup of all the important settingsthat are stored in the memory of the device.

You must not work at the antenna installation during a lightning.

Always keep a distance bigger than 40cm from the antenna in order to keep your exposure to electro-magnetic fields below the legal limits. This distance applies to Lambda/4 and Lambda/2 antennas.Larger distances apply for antennas with higher gain.

Adhere to the instructions documented in this user’s manual.

10.1.1. Declaration of Conformity

RACOM declares that under our own responsibility the products M!DGE/MG102i WirelessRouters comply with the relevant standards following the provisions of the Council Dir-ective 1999/5/EC.


Safety, environment, licensing

10.1.2. RoHS and WEEE compliance

The M!DGE/MG102i is fully compliant with the European Commission‟s RoHS (Restrictionof Certain Hazardous Substances in Electrical and Electronic Equipment) and WEEE(Waste Electrical and Electronic Equipment) environmental directives).

Restriction of hazardous substances (RoHS)

The RoHS Directive prohibits the sale in the European Union of electronic equipmentcontaining these hazardous substances: lead, cadmium, mercury, hexavalent chromium,polybrominated biphenyls (PBBs), and polybrominated diphenyl ethers (PBDEs).

End-of-life recycling programme (WEEE)

In accordance with the requirements of the council directive 2002/96/EC on WasteElectronical and Electronic Equipment (WEEE), ensure that at end-of-life you separatethis product from other waste and scrap and deliver it to the WEEE collection system inyour country for recycling.



10.2. Country of Origin

Country of Origin Declaration

Manufacturer: RACOM

Address: Mirova 1283, 592 31 Nove Mesto na Morave, Czech Republic

VAT No: CZ46343423

We, the manufacturer, hereby declare that Country of Origin of all the GSM products andits accessories is the Czech Republic, EU.

Nove Mesto na Morave,

Jiri Hruska, CEO

1 of March 2014

www.racom.euRACOM s.r.o. • Mirova 1283 • 592 31 Nove Mesto na Morave • Czech Republic

Tel.: +420 565 659 511 • Fax: +420 565 659 512 • E-mail: [email protected]

Part Number Description

MG102i-L dual SIM GPRS/EDGE/HSPA+/LTE router - 5Eth, RS232, 2DI, 2DO

MG102i-U dual SIM GPRS/EDGE/UMTS/HSPA router - 5Eth, RS232, 2DI, 2DO

MG102i-2UW-G dual module GPRS/EDGE/UMTS/HSPA router + WiFi + GPS

MG102_DINSET DIN rail mounting accessories

M!DGE-UMTS GPRS/EDGE/UMTS/HSPA router, 2Eth, RS232, 2DI, 2DO, DIN rail

M!DGE-LTE GPRS/EDGE/HSPA/LTE router, 2Eth, RS232, 2DI, 2DO, DIN rail

ver. 1.0

Fig. 10.1: Country of Origin declaration



10.3. Warranty

RACOM-supplied parts or equipment ("equipment") is covered by warranty for inherently faulty partsand workmanship for a warranty period as stated in the delivery documentation from the date of dispatchto the customer. The warranty does not cover custom modifications to software. During the warrantyperiod RACOM shall, on its option, fit, repair or replace ("service") faulty equipment, always providedthat malfunction has occurred during normal use, not due to improper use, whether deliberate or acci-dental, such as attempted repair or modification by any unauthorised person; nor due to the action ofabnormal or extreme environmental conditions such as overvoltage, liquid immersion or lightning strike.

Any equipment subject to repair under warranty must be returned by prepaid freight to RACOM direct.The serviced equipment shall be returned by RACOM to the customer by prepaid freight. If circumstancesdo not permit the equipment to be returned to RACOM, then the customer is liable and agrees to reim-burse RACOM for expenses incurred by RACOM during servicing the equipment on site. Whenequipment does not qualify for servicing under warranty, RACOM shall charge the customer and bereimbursed for costs incurred for parts and labour at prevailing rates.

This warranty agreement represents the full extent of the warranty cover provided by RACOM to thecustomer, as an agreement freely entered into by both parties.

RACOM warrants the equipment to function as described, without guaranteeing it as befitting customerintent or purpose. Under no circumstances shall RACOM's liability extend beyond the above, nor shallRACOM, its principals, servants or agents be liable for any consequential loss or damage caused directlyor indirectly through the use, misuse, function or malfunction of the equipment, always subject to suchstatutory protection as may explicitly and unavoidably apply hereto.



Appendix A. GlossaryAPN Access Point Name / Access Point Node

CE Conformity of equipment according to EU rules

CS Coding Scheme

CSD Circuit Switched Data

DHCP Dynamic Host Configuration Protocol

DMZ Demilitarized Zone

DNS Domain Name System

EDGE Enhanced Data Service for GSM Evolution

EMC Electromagnetic compatibility

FTP File Transfer Protocol

GPRS General Packet Radio Service

GSM Global System for Mobile communications

GUI Graphical User Interface

HSCSD High Speed Circuit Switched Data

HSDPA High-Speed Downlink Packet Access

HSUPA High-Speed Uplink Packet Access

HTML Hypertext Markup Language

HW Hardware

IP Internet Protocol

IPsec Internet Protocol Security

ISDN Integrated Services Digital Network

ISP Internet Service Provider

LAN Local Area Network

NAPT Network Address Port Translation

NAT Network Address Translation

POP Point of Presence

POP, POP3 Post Office Protocol, Version 3

PPP Point to Point Protocol


Glossary

RAS Remote Access Service (Dial-in Networking PPP)

RoHS Restriction of hazardous substances

SIM Subscriber Identity Module

SW Software

TCP Transmission Control Protocol

TFTP Trivial File Transfer Protocol

UDP User Datagram Protocol

UMTS Universal Mobile Telecommunications System

URL Universal Resource Locator

VPN Virtual Private Network

WEEE Waste Electrical and Electronic Equipment environmental directives


Glossary

Index

Aaccessories, 19antenna

GSM/UMTS, 21mounting, 23

authentication, 104

Bbasic setup, 22brc

COM, 42

Ccertificates, 116CLI, 123client

e-mail, 90COM

protocols, 40Command Line Interface, 123configuration, 24conformity, 138connecting M!DGE, 21connectors

Antenna SMA, 12ETH RJ45, 13screw terminal, 13USB, 13

Ddeclaration of conformity, 138demo case, 20digital I/O, 54dimensions, 12dynamic DNS, 89

Ee-mail, 90ethernet, 29event manager, 91

FF bracket, 19factory reset, 110features, 18

key features, 7file configuration, 108firewall, 62

Gglossary, 142grounding, 23

Hhome, 24

Iimplementation notes, 11indication LEDs, 16installation, 23interfaces, 25IPsec, 71

Kkeys, 116

LLAN cable, 21LED, 16legal notice, 120licensing, 120logout, 122

Mmenu

firewall, 62home, 24interfaces, 25logout, 122routing, 55services, 79system, 102troubleshooting, 110VPN, 68

mobile, 33models, 19mounting, 23

Oofferings, 19

Ppower supply, 23

connect, 21product

Conformity, 138protocols COM, 40protocolserver, 40


Rredundancy, 100reset, 110ROHS, 139router, 7routing, 55

Ssafety instructions, 138serial port, 38server

DHCP, 87dial-in, 78DNS proxy, 88PPTP, 76SSH/Telnet, 96web, 99

services, 79SIM, 33SIM card, 21SMS, 93SNMP agent, 97software update, 105specification, 18standards, 8start, 6system, 102

restart, 104settings, 102

Ttechnical specification, 18time&region, 103troubleshooting, 110, 136

Uupdate, 105USB, 36

VVPN, 68

WWAN, 25web configuration, 24WEEE, 139


Index

Appendix B. Revision History2012-10-09Revision 1.1

1st XML version

2012-12-07Revision 1.2Updated chapter 7 for FW version 3.6.40.x

2012-12-12Revision 1.3Updated chapter 8 – Command Line Interface

2013-10-09Revision 1.4Added section the section called “Protocol Server”

2014-09-04Revision 1.5Added information about Country of OriginComplete manual revision for FW version 3.6.41.x

2014-04-09Revision 1.6Complete manual revision for FW version 3.7.40.x

2015-01-10Revision 1.7Added section Section 7.7.8, “Legal Notice”,

2015-11-03Revision 1.8Complete manual revision for FW version 3.8.40.x

2016-03-21Revision 1.9Update sections Section 7.7, “SYSTEM”


Revision History

m!dge– gprs/umts/hspa+/lte router - karcz gettingstarted...

Documents